Bug 1548380 - RFE: Create flag to filter to sudo -l output
Summary: RFE: Create flag to filter to sudo -l output
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sudo
Version: 7.7
Hardware: All
OS: Linux
low
medium
Target Milestone: rc
: ---
Assignee: Daniel Kopeček
QA Contact: Martin Zelený
Mirek Jahoda
URL:
Whiteboard:
Depends On: 1547974
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-02-23 11:09 UTC by Daniele
Modified: 2018-10-30 11:09 UTC (History)
5 users (show)

Fixed In Version: sudo-1.8.23-1.el7
Doc Type: Enhancement
Doc Text:
*cvtsudoers* converts between different `sudoers` formats The new *cvtsudoers* utility enables the administrator to convert rules between different `sudoers` security policy file formats. See the `cvtsudoers(1)` man page for the list of available options and examples of usage.
Clone Of:
Environment:
Last Closed: 2018-10-30 11:09:01 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2018:3199 None None None 2018-10-30 11:09:46 UTC

Description Daniele 2018-02-23 11:09:28 UTC
Currently the output of sudo -l is not parseable out of the box, and contains 3 different sections:
- defaults for the host
- defaults for the user
- command that the user may run on the host

Example of sudo -l output is:
"""
Matching Defaults entries for root on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, log_output, maxseq=150,
    iolog_dir=/var/log/sudo-io/%{user}, !requiretty

Runas and Command-specific defaults for root:
    Defaults!/usr/bin/sudoreplay !log_output

User root may run the following commands on localhost:
    (ALL : ALL) ALL
"""

It would be very useful to have the following flags as optional to "-l":
--host-defaults
--user-defaults
--commands

It should be also possible to combinate the options (ie: sudo -l --host-defaults --user-defaults)

Example of the expected output:

sudo -l --host-defaults
"""
Matching Defaults entries for root on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, log_output, maxseq=150,
    iolog_dir=/var/log/sudo-io/%{user}, !requiretty
"""


sudo -l --user-defaults
"""
Runas and Command-specific defaults for root:
    Defaults!/usr/bin/sudoreplay !log_output
"""

sudo -l --commands
"""
User root may run the following commands on localhost:
    (ALL : ALL) ALL
"""

sudo -l --host-defaults --user-defaults
"""
Matching Defaults entries for root on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, log_output, maxseq=150,
    iolog_dir=/var/log/sudo-io/%{user}, !requiretty

Runas and Command-specific defaults for root:
    Defaults!/usr/bin/sudoreplay !log_output
"""

Comment 2 Daniele 2018-02-23 11:10:00 UTC
Upstream Tracker https://bugzilla.sudo.ws/show_bug.cgi?id=812

Comment 14 errata-xmlrpc 2018-10-30 11:09:01 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:3199


Note You need to log in before you can comment on or make changes to this bug.