Bug 1650174 - sudoers lens fails to parse always_query_group_plugin option [rhel-7.6.z]
Summary: sudoers lens fails to parse always_query_group_plugin option [rhel-7.6.z]
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: augeas
Version: 7.6
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Pino Toscano
QA Contact: YongkuiGuo
URL:
Whiteboard:
Depends On: 1649287
Blocks: 1610451
TreeView+ depends on / blocked
 
Reported: 2018-11-15 14:15 UTC by Oneata Mircea Teodor
Modified: 2019-07-04 08:12 UTC (History)
5 users (show)

Fixed In Version: augeas-1.4.0-6.el7_6.1
Doc Type: Bug Fix
Doc Text:
Prior to this update, Augeas was not able to read the default /etc/sudoers file provided by more recent versions of the sudo utility. The sudoers lens of Augeas has been fixed to parse also the always_query_group_plugin option. As a result, Augeas now reads default /etc/sudoers as expected.
Clone Of: 1649287
Environment:
Last Closed: 2019-01-29 17:22:29 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Github hercules-team augeas pull 588 'None' 'closed' 'Fix sudoers lens: "always_query_group_plugin"' 2019-12-02 05:58:03 UTC
Red Hat Product Errata RHBA-2019:0173 None None None 2019-01-29 17:22:30 UTC

Description Oneata Mircea Teodor 2018-11-15 14:15:25 UTC
This bug has been copied from bug #1649287 and has been proposed to be backported to 7.6 z-stream (EUS).

Comment 3 YongkuiGuo 2018-11-20 02:52:42 UTC
Verified with packages:
augeas-1.4.0-6.el7_6.1
sudo-1.8.23-3.el7

Steps:
1.
# augtool
augtool> print /files/etc/sudoers
/files/etc/sudoers
/files/etc/sudoers/#comment[1] = "# Sudoers allows particular users to run various commands as"
/files/etc/sudoers/#comment[2] = "# the root user, without needing the root password."
/files/etc/sudoers/#comment[3] = "#"
/files/etc/sudoers/#comment[4] = "# Examples are provided at the bottom of the file for collections"
/files/etc/sudoers/#comment[5] = "# of related commands, which can then be delegated out to particular"
/files/etc/sudoers/#comment[6] = "# users or groups."
/files/etc/sudoers/#comment[7] = "#"
/files/etc/sudoers/#comment[8] = "# This file must be edited with the 'visudo' command."
/files/etc/sudoers/#comment[9] = "# Host Aliases"
/files/etc/sudoers/#comment[10] = "# Groups of machines. You may prefer to use hostnames (perhaps using"
/files/etc/sudoers/#comment[11] = "# wildcards for entire domains) or IP addresses instead."
/files/etc/sudoers/#comment[12] = "Host_Alias     FILESERVERS = fs1, fs2"
/files/etc/sudoers/#comment[13] = "Host_Alias     MAILSERVERS = smtp, smtp2"
/files/etc/sudoers/#comment[14] = "# User Aliases"
/files/etc/sudoers/#comment[15] = "# These aren't often necessary, as you can use regular groups"
/files/etc/sudoers/#comment[16] = "# (ie, from files, LDAP, NIS, etc) in this file - just use %groupname"
/files/etc/sudoers/#comment[17] = "# rather than USERALIAS"
/files/etc/sudoers/#comment[18] = "User_Alias ADMINS = jsmith, mikem"
/files/etc/sudoers/#comment[19] = "# Command Aliases"
/files/etc/sudoers/#comment[20] = "# These are groups of related commands..."
/files/etc/sudoers/#comment[21] = "# Networking"
/files/etc/sudoers/#comment[22] = "Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool"
/files/etc/sudoers/#comment[23] = "# Installation and management of software"
/files/etc/sudoers/#comment[24] = "Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum"
/files/etc/sudoers/#comment[25] = "# Services"
/files/etc/sudoers/#comment[26] = "Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig, /usr/bin/systemctl start, /usr/bin/systemctl stop, /usr/bin/systemctl reload, /usr/bin/systemctl restart, /usr/bin/systemctl status, /usr/bin/systemctl enable, /usr/bin/systemctl disable"
/files/etc/sudoers/#comment[27] = "# Updating the locate database"
/files/etc/sudoers/#comment[28] = "Cmnd_Alias LOCATE = /usr/bin/updatedb"
/files/etc/sudoers/#comment[29] = "# Storage"
/files/etc/sudoers/#comment[30] = "Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount"
/files/etc/sudoers/#comment[31] = "# Delegating permissions"
/files/etc/sudoers/#comment[32] = "Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp"
/files/etc/sudoers/#comment[33] = "# Processes"
/files/etc/sudoers/#comment[34] = "Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall"
/files/etc/sudoers/#comment[35] = "# Drivers"
/files/etc/sudoers/#comment[36] = "Cmnd_Alias DRIVERS = /sbin/modprobe"
/files/etc/sudoers/#comment[37] = "Defaults specification"
/files/etc/sudoers/#comment[38] = "Refuse to run if unable to disable echo on the tty."
/files/etc/sudoers/Defaults[1]
/files/etc/sudoers/Defaults[1]/visiblepw
/files/etc/sudoers/Defaults[1]/visiblepw/negate
/files/etc/sudoers/#comment[39] = "Preserving HOME has security implications since many programs"
/files/etc/sudoers/#comment[40] = "use it when searching for configuration files. Note that HOME"
/files/etc/sudoers/#comment[41] = "is already set when the the env_reset option is enabled, so"
/files/etc/sudoers/#comment[42] = "this option is only effective for configurations where either"
/files/etc/sudoers/#comment[43] = "env_reset is disabled or HOME is present in the env_keep list."
/files/etc/sudoers/Defaults[2]
/files/etc/sudoers/Defaults[2]/always_set_home
/files/etc/sudoers/Defaults[3]
/files/etc/sudoers/Defaults[3]/match_group_by_gid
/files/etc/sudoers/#comment[44] = "Prior to version 1.8.15, groups listed in sudoers that were not"
/files/etc/sudoers/#comment[45] = "found in the system group database were passed to the group"
/files/etc/sudoers/#comment[46] = "plugin, if any. Starting with 1.8.15, only groups of the form"
/files/etc/sudoers/#comment[47] = "%:group are resolved via the group plugin by default."
/files/etc/sudoers/#comment[48] = "We enable always_query_group_plugin to restore old behavior."
/files/etc/sudoers/#comment[49] = "Disable this option for new behavior."
/files/etc/sudoers/Defaults[4]
/files/etc/sudoers/Defaults[4]/always_query_group_plugin
...


The option 'always_query_group_plugin' has been parsed correctly. So verified this bug.

Comment 5 errata-xmlrpc 2019-01-29 17:22:29 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0173


Note You need to log in before you can comment on or make changes to this bug.