I have a cell modem connected to my server that I want to use as a means to get notification emails out when the landline dies.To nicely separate normal network access and this exceptional cell modem access, I created a network namespace and created the network device in there as the only device.  To have a program use the cell modem I simply use ip netns exec.The wrinkle is that I want to allow any user to run any program they wish in the namespace, but netns exec requires root.  My solution is as follows:/usr/local/sbin/_oob_shim:#!/bin/shcmd_line=$@/bin/ip netns exec oob \    /usr/bin/sudo -u #$SUDO_UID -g #$SUDO_GID /bin/sh -c $cmd_line/etc/sudoers:ALL ALL=NOPASSWD: /usr/local/sbin/_oob_shimI figure the only way to run the shim without already being root or knowing the root password is through sudo, and I can trust sudo to set $SUDO_UID and $SUDO_GID to the right values.Am I opening myself up to significant risk?  Or, should I say am I missing any obvious caveats?
Secure way to allow any user to run programs in specific network namespace
networking;sudo;network namespaces
The only bug I see with your code is that you're running the user's command unnecessarily through sh -c when you should just run it directly. Running it through sh -c buys you nothing but it destroys quoting that the user originally put into the command. For example, try this:sudo /usr/local/sbin/_oob_shim ls -l a bshould list a file called a b inside the context of the namespace but instead it lists two files called a and b.sudo /usr/local/sbin/_oob_shim ls -l *should list a file called * (literal asterisk), fails for the same reason.So it should look like this instead:#!/bin/sh/bin/ip netns exec oob \    /usr/bin/sudo -u #$SUDO_UID -g #$SUDO_GID -- $@Makes the script simpler to boot!Another point I can make is that although in this case the bug was just a functionality bug, not a security bug, one is always suspicious when auditing security-sensitive code and finding that it runs things through shells because that's almost always a problem.Finally, the user's supplementary groups will not be propagated into the namespace (they get only their uid and main gid), but that doesn't seem like a huge problem and fixing that is not trivial.Other than that, it looks good to me.