add a blacklist, in addition to the whitelist

[calestyo]

Hi.

AFAIU, the program is right now purely whitelist based, i.e. if the command matches a single regexp in the config file, it's allowed.

I think it would be great to have a blacklist in addition, which supersedes any grants of the whitelist.
That would be handy to disallow symbols or strings, which are known to be exploitable in certain circumstances (like "..", or "$(" or things like that.

The blacklist could be used in two ways:

1. just removing any grants made by the whitelist, without allowing anything if not blacklisted and the whitelist is empty
2. the other way round, i.e. if the whitelist is empty, everything is allowed unless blacklisted.

If (2) is implemented in addition, then it should really be an option that needs to be passed to restricted-ssh-commands to activate that mode, cause if it's automatically enabled, just when the whitelist file is empty or not found, that would be too error prone.

Cheers,
Chris.

[bdrung]

Yes, the program is currently completely whitelist based.

I vote for implementing (1). The command has to match at least one whitelist regular expression, but none blacklist regular expression. To get the behaviour of (2), you just have to add one .* whitelist rule.

Can you propose a change of the configuration file format to support blacklisting?

[calestyo]

Your idea of implementing (2) is even much better than mine :)

I'd probably do it as described in #2.