isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace terms master and blacklist in docs and examples.

Browse Source
This commit is contained in:
Todd C. Miller
2020-06-15 14:38:46 -06:00
parent 4a3aff156f
commit f093cb2e52
9 changed files with 32 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
NEWS
View File

@@ -480,10 +480,10 @@ What's new in Sudo 1.8.25
* Fixed a bug introduced in sudo 1.8.24 where sudoNotAfter in the LDAP
back-end was not being properly parsed. Bug #845.
* When sudo runs a command in a pseudo-tty, the slave device is
now closed in the main process immediately after starting the
monitor process. This removes the need for an AIX-specific
workaround that was added in sudo 1.8.24.
* When sudo runs a command in a pseudo-terminal, the follower
device is now closed in the main process immediately after
starting the monitor process. This removes the need for an
AIX-specific workaround that was added in sudo 1.8.24.
* Added support for monotonic timers on HP-UX.

21
doc/sudoers.man.in
View File

@@ -25,7 +25,7 @@
.nr BA @BAMAN@
.nr LC @LCMAN@
.nr PS @PSMAN@
.TH "SUDOERS" "@mansectform@" "May 19, 2020" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
.TH "SUDOERS" "@mansectform@" "June 15, 2020" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
.nh
.if n .ad l
.SH "NAME"
@@ -379,13 +379,8 @@ explicitly denied by the
\fIenv_check\fR
and
\fIenv_delete\fR
options are
options are allowed and their values are
inherited from the invoking process.
In this case,
\fIenv_check\fR
and
\fIenv_delete\fR
behave like a blacklist.
Prior to version 1.8.21, environment variables with a value beginning with
\fR()\fR
were always removed.
@@ -395,7 +390,7 @@ is used to match
\fBbash\fR
shell functions instead.
Since it is not possible
to blacklist all potentially dangerous environment variables, use
to block all potentially dangerous environment variables, use
of the default
\fIenv_reset\fR
behavior is encouraged.
@@ -5267,7 +5262,7 @@ Defaults env_keep += "DISPLAY HOME"
# User alias specification
User_Alias FULLTIMERS = millert, mikef, dowdy
User_Alias PARTTIMERS = bostley, jwfox, crawl
User_Alias WEBMASTERS = will, wendy, wim
User_Alias WEBADMIN = will, wendy, wim
# Runas alias specification
Runas_Alias OP = root, operator
@@ -5281,7 +5276,7 @@ Host_Alias SPARC = bigtime, eclipse, moet, anchor :\e
HPPA = boa, nag, python
Host_Alias CUNETS = 128.138.0.0/255.255.0.0
Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
Host_Alias SERVERS = master, mail, www, ns
Host_Alias SERVERS = primary, mail, www, ns
Host_Alias CDROM = orion, perseus, hercules
# Cmnd alias specification
@@ -5605,7 +5600,7 @@ The user
may run any command on any machine except for those in the
\fISERVERS\fR
\fRHost_Alias\fR
(master, mail, www and ns).
(primary, mail, www and ns).
.nf
.sp
.RS 0n
@@ -5658,12 +5653,12 @@ needs to be able to kill hung processes.
.nf
.sp
.RS 0n
WEBMASTERS www = (www) ALL, (root) /usr/bin/su www
WEBADMIN www = (www) ALL, (root) /usr/bin/su www
.RE
.fi
.PP
On the host www, any user in the
\fIWEBMASTERS\fR
\fIWEBADMIN\fR
\fRUser_Alias\fR
(will, wendy, and wim), may run any command as user www (which owns the
web pages) or simply

21
doc/sudoers.mdoc.in
View File

@@ -24,7 +24,7 @@
.nr BA @BAMAN@
.nr LC @LCMAN@
.nr PS @PSMAN@
.Dd May 19, 2020
.Dd June 15, 2020
.Dt SUDOERS @mansectform@
.Os Sudo @PACKAGE_VERSION@
.Sh NAME
@@ -369,13 +369,8 @@ explicitly denied by the
.Em env_check
and
.Em env_delete
options are
options are allowed and their values are
inherited from the invoking process.
In this case,
.Em env_check
and
.Em env_delete
behave like a blacklist.
Prior to version 1.8.21, environment variables with a value beginning with
.Li ()
were always removed.
@@ -385,7 +380,7 @@ is used to match
.Sy bash
shell functions instead.
Since it is not possible
to blacklist all potentially dangerous environment variables, use
to block all potentially dangerous environment variables, use
of the default
.Em env_reset
behavior is encouraged.
@@ -4902,7 +4897,7 @@ Defaults env_keep += "DISPLAY HOME"
# User alias specification
User_Alias FULLTIMERS = millert, mikef, dowdy
User_Alias PARTTIMERS = bostley, jwfox, crawl
User_Alias WEBMASTERS = will, wendy, wim
User_Alias WEBADMIN = will, wendy, wim
# Runas alias specification
Runas_Alias OP = root, operator
@@ -4916,7 +4911,7 @@ Host_Alias SPARC = bigtime, eclipse, moet, anchor :\e
HPPA = boa, nag, python
Host_Alias CUNETS = 128.138.0.0/255.255.0.0
Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
Host_Alias SERVERS = master, mail, www, ns
Host_Alias SERVERS = primary, mail, www, ns
Host_Alias CDROM = orion, perseus, hercules
# Cmnd alias specification
@@ -5198,7 +5193,7 @@ The user
may run any command on any machine except for those in the
.Em SERVERS
.Li Host_Alias
(master, mail, www and ns).
(primary, mail, www and ns).
.Bd -literal
jill SERVERS = /usr/bin/, !SU, !SHELLS
.Ed
@@ -5240,11 +5235,11 @@ On his personal workstation, valkyrie,
.Sy matt
needs to be able to kill hung processes.
.Bd -literal
WEBMASTERS www = (www) ALL, (root) /usr/bin/su www
WEBADMIN www = (www) ALL, (root) /usr/bin/su www
.Ed
.Pp
On the host www, any user in the
.Em WEBMASTERS
.Em WEBADMIN
.Li User_Alias
(will, wendy, and wim), may run any command as user www (which owns the
web pages) or simply

8
examples/sudoers
View File

@@ -20,7 +20,7 @@ Defaults!PAGERS noexec
##
User_Alias FULLTIMERS = millert, mikef, dowdy
User_Alias PARTTIMERS = bostley, jwfox, crawl
User_Alias WEBMASTERS = will, wendy, wim
User_Alias WEBADMIN = will, wendy, wim
##
# Runas alias specification
@@ -37,7 +37,7 @@ Host_Alias SPARC = bigtime, eclipse, moet, anchor:\
HPPA = boa, nag, python
Host_Alias CUNETS = 128.138.0.0/255.255.0.0
Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
Host_Alias SERVERS = master, mail, www, ns
Host_Alias SERVERS = primary, mail, www, ns
Host_Alias CDROM = orion, perseus, hercules
##
@@ -123,10 +123,10 @@ steve CSNETS = (operator) /usr/local/op_commands/
# they get hung.
matt valkyrie = KILL
# users in the WEBMASTERS User_Alias (will, wendy, and wim)
# users in the WEBADMIN User_Alias (will, wendy, and wim)
# may run any command as user www (which owns the web pages)
# or simply su to www.
WEBMASTERS www = (www) ALL, (root) /usr/bin/su www
WEBADMIN www = (www) ALL, (root) /usr/bin/su www
# anyone can mount/unmount a cd-rom on the machines in the CDROM alias
ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\

8
plugins/sudoers/regress/cvtsudoers/sudoers
View File

@@ -20,7 +20,7 @@ Defaults!PAGERS noexec
##
User_Alias FULLTIMERS = millert, mikef, dowdy
User_Alias PARTTIMERS = bostley, jwfox, crawl
User_Alias WEBMASTERS = will, wendy, wim
User_Alias WEBADMIN = will, wendy, wim
##
# Runas alias specification
@@ -37,7 +37,7 @@ Host_Alias SPARC = bigtime, eclipse, moet, anchor:\
HPPA = boa, nag, python
Host_Alias CUNETS = 128.138.0.0/255.255.0.0
Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
Host_Alias SERVERS = master, mail, www, ns
Host_Alias SERVERS = primary, mail, www, ns
Host_Alias CDROM = orion, perseus, hercules
##
@@ -116,10 +116,10 @@ steve CSNETS = (operator) /usr/local/op_commands/
# they get hung.
matt valkyrie = KILL
# users in the WEBMASTERS User_Alias (will, wendy, and wim)
# users in the WEBADMIN User_Alias (will, wendy, and wim)
# may run any command as user www (which owns the web pages)
# or simply su to www.
WEBMASTERS www = (www) ALL, (root) /usr/bin/su www
WEBADMIN www = (www) ALL, (root) /usr/bin/su www
# anyone can mount/unmount a cd-rom on the machines in the CDROM alias
ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\

2
plugins/sudoers/regress/cvtsudoers/sudoers.defs
View File

@@ -8,7 +8,7 @@ Defaults!PAGERS noexec
User_Alias FULLTIMERS = millert, mikef, dowdy
User_Alias PARTTIMERS = bostley, jwfox, crawl
Host_Alias SERVERS = master, mail, www, ns
Host_Alias SERVERS = primary, mail, www, ns
Host_Alias CDROM = orion, perseus, hercules
Cmnd_Alias VIPW = /usr/sbin/vipw, /usr/bin/passwd, /usr/bin/chsh, \

2
plugins/sudoers/regress/cvtsudoers/test13.out.ok
View File

@@ -3,5 +3,5 @@ Defaults@SERVERS log_year, logfile=/var/log/sudo.log
Host_Alias CDROM = orion, perseus, hercules
Runas_Alias OPERATOR = operator, backup
User_Alias PARTTIMERS = bostley, jwfox, crawl
Host_Alias SERVERS = master, mail, www, ns
Host_Alias SERVERS = primary, mail, www, ns
Cmnd_Alias VIPW = /usr/sbin/vipw, /usr/bin/passwd, /usr/bin/chsh, /usr/bin/chfn

2
plugins/sudoers/regress/cvtsudoers/test19.out.ok
View File

@@ -6,6 +6,6 @@ Defaults!PAGERS noexec
User_Alias FULLTIMERS = millert, mikef, dowdy
Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
Host_Alias SERVERS = master, mail, www, ns
Host_Alias SERVERS = primary, mail, www, ns
FULLTIMERS ALL = NOPASSWD: ALL

2
plugins/sudoers/regress/visudo/test6.sh
View File

@@ -19,7 +19,7 @@ User_Alias FULLTIMERS = millert, mikef, dowdy
Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
Host_Alias SERVERS = master, mail, www, ns
Host_Alias SERVERS = primary, mail, www, ns
EOF
exit 0