From: Todd C. Miller Date: Mon, 5 Feb 1996 21:10:20 +0000 (+0000) Subject: redid section describing sample sudoers stuff X-Git-Tag: SUDO_1_5_0~278 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7cb5af2dc44d4800ae782dbd2b29f5b41a1d4696;p=sudo redid section describing sample sudoers stuff --- diff --git a/sudoers.pod b/sudoers.pod index 753279357..7177284a5 100644 --- a/sudoers.pod +++ b/sudoers.pod @@ -23,7 +23,7 @@ will be used. host_type ::= a lower-case hostname, netgroup, ip address, network number, or host alias. cmnd_type ::= an command OR a command alias. - op ::= the logical '!' NOT operator. + op ::= the logical "!" NOT operator. =head2 host alias section format: @@ -69,16 +69,16 @@ B define an alias of I, it will B be used. Note that I implies the entire universe of hosts/users/commands. You can subtract elements from the universe by using the syntax: user host=ALL,!ALIAS1,!/etc/halt... -Note that the '!' notation only works in a user's command list. You +Note that the "!" notation only works in a user's command list. You may not use it to subtract elements in a User_Alias, Host_Alias, or Cmnd_Alias. Commands may have optional command line arguments. If they do, -then the arguments in the sudoers file must exactly match those +then the arguments in the I file must exactly match those on the command line. It is also possible to have a command's arguments span multiple lines as long as the line continuance -character '\' is used. The following characters must be escaped -with a '\' if used in command arguments: ',', ':', '=', '\'. +character "\" is used. The following characters must be escaped +with a "\" if used in command arguments: ",", ":", "=", "\". =head1 EXAMPLES @@ -114,33 +114,96 @@ with a '\' if used in command arguments: ',', ':', '=', '\'. kodiakthorn=ALL steve CSNETS=/usr/op_commands/,/bin/su operator -The above I file specification is composed of 4 host alias -specifications, 2 user alias specifications, 4 command alias -specifications and 8 user specifications. Full time staff (those -in the FULLTIME alias) and anyone in group I are allowed to -execute any command on any host. Part time staff (those in the PARTTIME -alias) are allowed to execute any command except for the group of SHELL -and SU commands on any machine. Britt is permitted to execute /etc/halt, -/etc/shutdown, /usr/etc/lpc and /usr/ucb/lprm on the REMOTE machines (merlin, -kodiakthorn, and spirit). Nieusma is allowed to run /etc/halt, /etc/shutdown, -and /etc/halt on all machines and all commands except for the group of SHELL -commands on the HUB machines. Jill is permitted to execute /etc/shutdown with -the I<-r now> flags, F, and F on houdini. Davehieb can -execute any command on machines merlin and kodiakthorn and can halt the -SERVERS. Any user in the netgroup I may run any command on the -machines in the netgroup I except for those commands in the groups -SHELL and SU. Steve can run any command located in the directory -F on all machines on the subnets listed in B -(note that the 128.138.192 net has a netmask of 255.255.255.192 which -is why its network number is 128.138.192.192). He may also C to -operator but to no one else. - -B will do a logical and of a machine's ip address(es) with -its netmask to decide whether that machine is on a given network). +=head2 Host Alias specifications: + +The are four I. The first actually contains +two I. It sets C to be C and C +to the three machines C, C and C. +Similarly, C is set to the machines C, C, +C and C. The C alias will match +any host on the 128.138.243.0, 128.138.204.0, or 128.138.205.192 +nets. Note that these are B addresses, not ip addresses. +The local I is used to determine whether or not the +current host belongs to a network. + +=head2 User Alias specifications: + +The two I simply groups the C and +C folks into two separate aliases. + +=head2 Command alias specifications: + +Command aliases are lists of commands with or without associated +command line arguments. The entries above should be self-explanatory. + +=head2 User specifications: + +=over 16 + +=item FULLTIME + +Full-time sysadmins in the C alias may run any +command on any host. + +=item %wheel + +Any user in the UN*X group C may run any +command on any host. + +=item PARTTIME + +Part-time sysadmins in the C alias may run any +command except those in the C and C aliases +on any host. + +=item +interns + +Any user in the netgroup C may run any +command except those in the C and C aliases +on any host that is in the C netgroup. + +=item britt + +The user C may run commands in the C alias +on the C machines and commands in the C alias +on any machine. + +=item nieusma + +The user C may run commands in the C alias +as well as F on the C machines and +any command except those in the C alias on the C +machines. + +=item jill + +The user C may run C as well as +the commands in the C alias on houdini. + +=item markm + +The user C may run any command on the C machines +except F, F, and commands listed +in the C alias. + +=item davehieb + +The user C may run any command on C, +F on the C and any command on C. + +=item steve + +The user C may run any command in the F +directory and C on the machines on C. + +=back + +=head1 CAVEATS + The I file should B be edited by the B command which locks the file and does grammatical checking. It is imperative that the I be free of syntax errors since sudo -will not run with a syntactically incorrect sudoers file. +will not run with a syntactically incorrect I file. =head1 FILES