[sudo-users] How to preserve functions in scripts for calling by sudo?

[L A Walsh]

It gets worse in development where mistakes can really bite.

All I need to do as root is 'mv' (to a tmpname) and 'rm' on the tmpdir.

In a test run, the script running as full root, renamed and deleted
the kernel devel-dir having 73 different kernel dirs w/reference
dirs for each version used, and devel-dirs for 2 machines going back
~4 years. Not "ideal".

Fortunately, I had daily incrementals from the beginning of the month
(May).  The level 0 restore in a 1.1TB file (not compressed or on
tape as they slow things down more) took 50 minutes to restore
91G in *283 million* files (that only take 34G on disk due
to hard-links). I create new kernel trees from the latest-previous,
using cp-al, and patches and the devel dirs as exact matches of
the ref-dirs.

That broke recently as the kernel switched their patch format
to a newer git-format unsupported by the gnu-patch program.

Even with the git-apply (as in apply patch), some patches don't
apply cleanly, which tells my script to halt.  It's hard for
my script to know how serious an exit code is. So...
fix&upgrade time.

To protect myself, I've been refactoring the script -- but that
involves (among other things) taking common sections and putting
them in functions.  This script has 11 functions.  I am
putting check code around the deletion points, but since those
get used multiple times, again,  a function is the best idea.
 
> For example, for a function call "ll" and
> post-shellshock version of bash you could use the following:
>
> Defaults env_keep += "BASH_FUNC_ll%%=()*"
So can you explain why it is detrimental to security to allow root
to use functions in its system management scripts?

It seems like it is more likely to cause problems if people have
to run the whole script as root or try to find a way around the problem.

Thanks,
-linda