[PR #122] Feature: Optional adding the OS user to a OS group #127

New issue

Open

opened 2026-10-18 21:11:03 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-18 21:11:03 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-terminal/pull/122
Author: @ohmer1
Created: 5/6/2026
Status: 🔄 Open

Base: main ← Head: feature-add-usergroup

📝 Commits (1)

e410702 Optional adding the OS user to a OS group

📊 Changes

2 files changed (+10 additions, -0 deletions)

View changed files

📝 open_terminal/env.py (+5 -0)
📝 open_terminal/utils/user_isolation.py (+5 -0)

📄 Description

This PR adds an OS user to an existing OS group. This feature is used to further restrict sudo privileges by limiting them to runas members of a specific group only. Here is an example :

The USER_GROUP variable have otusers as value. The USER_PREFIX have ot_ as value. The service run as openterminal user. My sudoers file is the following.

Defaults:openterminal !requiretty, !use_pty, !pam_session

Cmnd_Alias OPENTERMINAL_CMDS = \
    /usr/sbin/useradd ^-m -s /bin/bash ot_[a-z0-9_]{1,32}$, \
    /usr/bin/chown ^(-R )?ot_[a-z0-9_]{1,32}:ot_[a-z0-9_]{1,32} /home/ot_[a-z0-9_]{1,32}(/[a-zA-ZÀÂÄÉÈÊËÎÏÔÖÙÛÜÇàâäéèêëîïôöùûüç0-9_][a-zA-ZÀÂÄÉÈÊËÎÏÔÖÙÛÜÇàâäéèêëîïôöùûüç0-9%&_.+\$()\ -]*)*/?$, \
    /usr/bin/chmod ^2770 /home/ot_[a-z0-9_]{1,32}(/[a-zA-ZÀÂÄÉÈÊËÎÏÔÖÙÛÜÇàâäéèêëîïôöùûüç0-9_][a-zA-ZÀÂÄÉÈÊËÎÏÔÖÙÛÜÇàâäéèêëîïôöùûüç0-9%&_.+\$()\ -]*)*/?$, \
    /usr/bin/chmod ^g\+w /home/ot_[a-z0-9_]{1,32}(/[a-zA-ZÀÂÄÉÈÊËÎÏÔÖÙÛÜÇàâäéèêëîïôöùûüç0-9_][a-zA-ZÀÂÄÉÈÊËÎÏÔÖÙÛÜÇàâäéèêëîïôöùûüç0-9%&_.+\$()\ -]*)*/?$, \
    /usr/sbin/usermod ^-aG otusers ot_[a-z0-9_]{1,32}$, \
    /usr/sbin/usermod ^-aG ot_[a-z0-9_]{1,32} openterminal$

openterminal ALL=(root) NOPASSWD: OPENTERMINAL_CMDS

openterminal ALL=(%otusers) NOPASSWD: ALL

The service's privileges are constrained on two fronts:

When acting as root, it is restricted to the explicitly defined OPENTERMINAL_CMDS allowlist, covering only the necessary useradd, chown, chmod, and usermod operations.
When impersonating other users, it can only do so for members of the otusers group, preventing any lateral movement to unrelated system accounts.

This ensures the service cannot gain unrestricted root access or impersonate arbitrary users, significantly limiting its attack surface. I also constrained the systemd service, but this is out of scope of this PR and doesn't require patch.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-terminal/pull/122 **Author:** [@ohmer1](https://github.com/ohmer1) **Created:** 5/6/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `feature-add-usergroup` --- ### 📝 Commits (1) - [`e410702`](https://github.com/open-webui/open-terminal/commit/e410702b0d462ef0b2918a2d3f7617da46f07759) Optional adding the OS user to a OS group ### 📊 Changes **2 files changed** (+10 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `open_terminal/env.py` (+5 -0) 📝 `open_terminal/utils/user_isolation.py` (+5 -0) </details> ### 📄 Description This PR adds an OS user to an existing OS group. This feature is used to further restrict sudo privileges by limiting them to runas members of a specific group only. Here is an example : The USER_GROUP variable have `otusers` as value. The USER_PREFIX have `ot_` as value. The service run as `openterminal` user. My sudoers file is the following. ``` Defaults:openterminal !requiretty, !use_pty, !pam_session Cmnd_Alias OPENTERMINAL_CMDS = \ /usr/sbin/useradd ^-m -s /bin/bash ot_[a-z0-9_]{1,32}$, \ /usr/bin/chown ^(-R )?ot_[a-z0-9_]{1,32}:ot_[a-z0-9_]{1,32} /home/ot_[a-z0-9_]{1,32}(/[a-zA-ZÀÂÄÉÈÊËÎÏÔÖÙÛÜÇàâäéèêëîïôöùûüç0-9_][a-zA-ZÀÂÄÉÈÊËÎÏÔÖÙÛÜÇàâäéèêëîïôöùûüç0-9%&_.+\$()\ -]*)*/?$, \ /usr/bin/chmod ^2770 /home/ot_[a-z0-9_]{1,32}(/[a-zA-ZÀÂÄÉÈÊËÎÏÔÖÙÛÜÇàâäéèêëîïôöùûüç0-9_][a-zA-ZÀÂÄÉÈÊËÎÏÔÖÙÛÜÇàâäéèêëîïôöùûüç0-9%&_.+\$()\ -]*)*/?$, \ /usr/bin/chmod ^g\+w /home/ot_[a-z0-9_]{1,32}(/[a-zA-ZÀÂÄÉÈÊËÎÏÔÖÙÛÜÇàâäéèêëîïôöùûüç0-9_][a-zA-ZÀÂÄÉÈÊËÎÏÔÖÙÛÜÇàâäéèêëîïôöùûüç0-9%&_.+\$()\ -]*)*/?$, \ /usr/sbin/usermod ^-aG otusers ot_[a-z0-9_]{1,32}$, \ /usr/sbin/usermod ^-aG ot_[a-z0-9_]{1,32} openterminal$ openterminal ALL=(root) NOPASSWD: OPENTERMINAL_CMDS openterminal ALL=(%otusers) NOPASSWD: ALL ``` The service's privileges are constrained on two fronts: - When acting as root, it is restricted to the explicitly defined OPENTERMINAL_CMDS allowlist, covering only the necessary useradd, chown, chmod, and usermod operations. - When impersonating other users, it can only do so for members of the otusers group, preventing any lateral movement to unrelated system accounts. This ensures the service cannot gain unrestricted root access or impersonate arbitrary users, significantly limiting its attack surface. I also constrained the systemd service, but this is out of scope of this PR and doesn't require patch. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-18 21:11:03 +00:00

No labels

bug

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

open-webui/open-terminal#127

No description provided.

Rows
Columns