Any way to avoid privilege escalation for www-data user?

[xalt7x]

After Standard Installation there are such permissions for www-data user

sudo -l -U www-data

User www-data may run the following commands on debian:
(bbs-*) NOPASSWD: /usr/bin/borg, /usr/local/bin/borg, /usr/bin/rclone, /usr/bin/env
(root) NOPASSWD: /usr/local/bin/bbs-ssh-helper, /var/www/bbs/bin/bbs-update

/usr/bin/env seem dangerous as it allows to run an arbitrary command. For example, start shell and read unprotected OS files.

sudo -u bbs-machine1 /usr/bin/env /bin/sh -c 'ls -la /'

Can BBS work without /usr/bin/env permission?

As for the root NOPASSWD, can I remove permissions and launch these scripts run manually? They could also pose a security risk if, for example, the BBS repository were to be compromised.

It seems that the best way to address these security concerns without adding additional maintenance is to run BBS in Docker on a dedicated machine.

[marcpope]

Thanks for your comments. Running BBS in a Docker or dedicated VM is probably the best bet. But there are a few fragments left over from previous versions that might be able to be eliminated. It's going to take a little time to test.