Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1548380 - RFE: Create flag to filter to sudo -l output
RFE: Create flag to filter to sudo -l output
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sudo (Show other bugs)
7.7
All Linux
low Severity medium
: rc
: ---
Assigned To: Daniel Kopeček
Martin Zelený
Mirek Jahoda
: FutureFeature, Triaged
Depends On: 1547974
Blocks:
  Show dependency treegraph
 
Reported: 2018-02-23 06:09 EST by Daniele
Modified: 2018-10-30 07:09 EDT (History)
5 users (show)

See Also:
Fixed In Version: sudo-1.8.23-1.el7
Doc Type: Enhancement
Doc Text:
*cvtsudoers* converts between different `sudoers` formats The new *cvtsudoers* utility enables the administrator to convert rules between different `sudoers` security policy file formats. See the `cvtsudoers(1)` man page for the list of available options and examples of usage.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2018-10-30 07:09:01 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2018:3199 None None None 2018-10-30 07:09 EDT

  None (edit)
Description Daniele 2018-02-23 06:09:28 EST
Currently the output of sudo -l is not parseable out of the box, and contains 3 different sections:
- defaults for the host
- defaults for the user
- command that the user may run on the host

Example of sudo -l output is:
"""
Matching Defaults entries for root on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, log_output, maxseq=150,
    iolog_dir=/var/log/sudo-io/%{user}, !requiretty

Runas and Command-specific defaults for root:
    Defaults!/usr/bin/sudoreplay !log_output

User root may run the following commands on localhost:
    (ALL : ALL) ALL
"""

It would be very useful to have the following flags as optional to "-l":
--host-defaults
--user-defaults
--commands

It should be also possible to combinate the options (ie: sudo -l --host-defaults --user-defaults)

Example of the expected output:

sudo -l --host-defaults
"""
Matching Defaults entries for root on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, log_output, maxseq=150,
    iolog_dir=/var/log/sudo-io/%{user}, !requiretty
"""


sudo -l --user-defaults
"""
Runas and Command-specific defaults for root:
    Defaults!/usr/bin/sudoreplay !log_output
"""

sudo -l --commands
"""
User root may run the following commands on localhost:
    (ALL : ALL) ALL
"""

sudo -l --host-defaults --user-defaults
"""
Matching Defaults entries for root on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, log_output, maxseq=150,
    iolog_dir=/var/log/sudo-io/%{user}, !requiretty

Runas and Command-specific defaults for root:
    Defaults!/usr/bin/sudoreplay !log_output
"""
Comment 2 Daniele 2018-02-23 06:10:00 EST
Upstream Tracker https://bugzilla.sudo.ws/show_bug.cgi?id=812
Comment 14 errata-xmlrpc 2018-10-30 07:09:01 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:3199

Note You need to log in before you can comment on or make changes to this bug.