From b9754f605b2a9bf784edf7e8ef854552bf234446 Mon Sep 17 00:00:00 2001 From: d3m0k1d Date: Tue, 27 Jan 2026 16:20:03 +0300 Subject: [PATCH] fix: Delete sudo calls on exec --- internal/blocker/firewalld.go | 8 ++++---- internal/blocker/iptables.go | 8 ++++---- internal/blocker/nftables.go | 14 +++++++------- internal/blocker/ufw.go | 8 ++++---- 4 files changed, 19 insertions(+), 19 deletions(-) diff --git a/internal/blocker/firewalld.go b/internal/blocker/firewalld.go index de7acb5..d5b80b8 100644 --- a/internal/blocker/firewalld.go +++ b/internal/blocker/firewalld.go @@ -21,14 +21,14 @@ func (f *Firewalld) Ban(ip string) error { if err != nil { return err } - cmd := exec.Command("sudo", "firewall-cmd", "--zone=drop", "--add-source", ip, "--permanent") + cmd := exec.Command("firewall-cmd", "--zone=drop", "--add-source", ip, "--permanent") output, err := cmd.CombinedOutput() if err != nil { f.logger.Error(err.Error()) return err } f.logger.Info("Add source " + ip + " " + string(output)) - output, err = exec.Command("sudo", "firewall-cmd", "--reload").CombinedOutput() + output, err = exec.Command("firewall-cmd", "--reload").CombinedOutput() if err != nil { f.logger.Error(err.Error()) return err @@ -42,14 +42,14 @@ func (f *Firewalld) Unban(ip string) error { if err != nil { return err } - cmd := exec.Command("sudo", "firewall-cmd", "--zone=drop", "--remove-source", ip, "--permanent") + cmd := exec.Command("firewall-cmd", "--zone=drop", "--remove-source", ip, "--permanent") output, err := cmd.CombinedOutput() if err != nil { f.logger.Error(err.Error()) return err } f.logger.Info("Remove source " + ip + " " + string(output)) - output, err = exec.Command("sudo", "firewall-cmd", "--reload").CombinedOutput() + output, err = exec.Command("firewall-cmd", "--reload").CombinedOutput() if err != nil { f.logger.Error(err.Error()) return err diff --git a/internal/blocker/iptables.go b/internal/blocker/iptables.go index 4b46cdc..3b93d14 100644 --- a/internal/blocker/iptables.go +++ b/internal/blocker/iptables.go @@ -27,7 +27,7 @@ func (f *Iptables) Ban(ip string) error { if err != nil { return err } - cmd := exec.Command("sudo", "iptables", "-A", "INPUT", "-s", ip, "-j", "DROP") + cmd := exec.Command("iptables", "-A", "INPUT", "-s", ip, "-j", "DROP") output, err := cmd.CombinedOutput() if err != nil { f.logger.Error("failed to ban IP", @@ -45,7 +45,7 @@ func (f *Iptables) Ban(ip string) error { return err } // #nosec G204 - f.config is validated above via validateConfigPath() - cmd = exec.Command("sudo", "iptables-save", "-f", f.config) + cmd = exec.Command("iptables-save", "-f", f.config) output, err = cmd.CombinedOutput() if err != nil { f.logger.Error("failed to save config", @@ -69,7 +69,7 @@ func (f *Iptables) Unban(ip string) error { if err != nil { return err } - cmd := exec.Command("sudo", "iptables", "-D", "INPUT", "-s", ip, "-j", "DROP") + cmd := exec.Command("iptables", "-D", "INPUT", "-s", ip, "-j", "DROP") output, err := cmd.CombinedOutput() if err != nil { f.logger.Error("failed to unban IP", @@ -87,7 +87,7 @@ func (f *Iptables) Unban(ip string) error { return err } // #nosec G204 - f.config is validated above via validateConfigPath() - cmd = exec.Command("sudo", "iptables-save", "-f", f.config) + cmd = exec.Command("iptables-save", "-f", f.config) output, err = cmd.CombinedOutput() if err != nil { f.logger.Error("failed to save config", diff --git a/internal/blocker/nftables.go b/internal/blocker/nftables.go index f161783..2905b5a 100644 --- a/internal/blocker/nftables.go +++ b/internal/blocker/nftables.go @@ -26,7 +26,7 @@ func (n *Nftables) Ban(ip string) error { return err } - cmd := exec.Command("sudo", "nft", "add", "rule", "inet", "banforge", "banned", + cmd := exec.Command("nft", "add", "rule", "inet", "banforge", "banned", "ip", "saddr", ip, "drop") output, err := cmd.CombinedOutput() if err != nil { @@ -70,7 +70,7 @@ func (n *Nftables) Unban(ip string) error { return fmt.Errorf("no rule found for IP %s", ip) } // #nosec G204 - handle is extracted from nftables output and validated - cmd := exec.Command("sudo", "nft", "delete", "rule", "inet", "banforge", "banned", + cmd := exec.Command("nft", "delete", "rule", "inet", "banforge", "banned", "handle", handle) output, err := cmd.CombinedOutput() if err != nil { @@ -112,7 +112,7 @@ func (n *Nftables) Setup(config string) error { } } ` - cmd := exec.Command("sudo", "tee", config) + cmd := exec.Command("tee", config) stdin, err := cmd.StdinPipe() if err != nil { return fmt.Errorf("failed to create stdin pipe: %w", err) @@ -135,7 +135,7 @@ func (n *Nftables) Setup(config string) error { return fmt.Errorf("failed to save config: %w", err) } - cmd = exec.Command("sudo", "nft", "-f", config) + cmd = exec.Command("nft", "-f", config) output, err := cmd.CombinedOutput() if err != nil { return fmt.Errorf("failed to load nftables config: %s", string(output)) @@ -145,7 +145,7 @@ func (n *Nftables) Setup(config string) error { } func (n *Nftables) findRuleHandle(ip string) (string, error) { - cmd := exec.Command("sudo", "nft", "-a", "list", "chain", "inet", "banforge", "banned") + cmd := exec.Command("nft", "-a", "list", "chain", "inet", "banforge", "banned") output, err := cmd.CombinedOutput() if err != nil { return "", fmt.Errorf("failed to list chain rules: %w", err) @@ -172,13 +172,13 @@ func saveNftablesConfig(configPath string) error { return err } - cmd := exec.Command("sudo", "nft", "list", "ruleset") + cmd := exec.Command("nft", "list", "ruleset") output, err := cmd.CombinedOutput() if err != nil { return fmt.Errorf("failed to get nftables ruleset: %w", err) } - cmd = exec.Command("sudo", "tee", configPath) + cmd = exec.Command("tee", configPath) stdin, err := cmd.StdinPipe() if err != nil { return fmt.Errorf("failed to create stdin pipe: %w", err) diff --git a/internal/blocker/ufw.go b/internal/blocker/ufw.go index 3a0ac44..3e90fcb 100644 --- a/internal/blocker/ufw.go +++ b/internal/blocker/ufw.go @@ -23,7 +23,7 @@ func (u *Ufw) Ban(ip string) error { return err } - cmd := exec.Command("sudo", "ufw", "--force", "deny", "from", ip) + cmd := exec.Command("ufw", "--force", "deny", "from", ip) output, err := cmd.CombinedOutput() if err != nil { u.logger.Error("failed to ban IP", @@ -42,7 +42,7 @@ func (u *Ufw) Unban(ip string) error { return err } - cmd := exec.Command("sudo", "ufw", "--force", "delete", "deny", "from", ip) + cmd := exec.Command("ufw", "--force", "delete", "deny", "from", ip) output, err := cmd.CombinedOutput() if err != nil { u.logger.Error("failed to unban IP", @@ -59,7 +59,7 @@ func (u *Ufw) Unban(ip string) error { func (u *Ufw) Setup(config string) error { if config != "" { fmt.Printf("Ufw dont support config file\n") - cmd := exec.Command("sudo", "ufw", "enable") + cmd := exec.Command("ufw", "enable") output, err := cmd.CombinedOutput() if err != nil { u.logger.Error("failed to enable ufw", @@ -69,7 +69,7 @@ func (u *Ufw) Setup(config string) error { } } if config == "" { - cmd := exec.Command("sudo", "ufw", "enable") + cmd := exec.Command("ufw", "enable") output, err := cmd.CombinedOutput() if err != nil { u.logger.Error("failed to enable ufw",