isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Replace terms master and blacklist in docs and examples.

Browse Source
This commit is contained in:
Todd C. Miller
2020-06-15 14:38:46 -06:00
parent 4a3aff156f
commit f093cb2e52
9 changed files with 32 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
NEWS
View File

@@ -480,10 +480,10 @@ What's new in Sudo 1.8.25
* Fixed a bug introduced in sudo 1.8.24 where sudoNotAfter in the LDAP * Fixed a bug introduced in sudo 1.8.24 where sudoNotAfter in the LDAP
back-end was not being properly parsed. Bug #845. back-end was not being properly parsed. Bug #845.
* When sudo runs a command in a pseudo-tty, the slave device is * When sudo runs a command in a pseudo-terminal, the follower
now closed in the main process immediately after starting the device is now closed in the main process immediately after
monitor process. This removes the need for an AIX-specific starting the monitor process. This removes the need for an
workaround that was added in sudo 1.8.24. AIX-specific workaround that was added in sudo 1.8.24.
* Added support for monotonic timers on HP-UX. * Added support for monotonic timers on HP-UX.

21
doc/sudoers.man.in
View File

@@ -25,7 +25,7 @@
.nr BA @BAMAN@ .nr BA @BAMAN@
.nr LC @LCMAN@ .nr LC @LCMAN@
.nr PS @PSMAN@ .nr PS @PSMAN@
.TH "SUDOERS" "@mansectform@" "May 19, 2020" "Sudo @PACKAGE_VERSION@" "File Formats Manual" .TH "SUDOERS" "@mansectform@" "June 15, 2020" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
.nh .nh
.if n .ad l .if n .ad l
.SH "NAME" .SH "NAME"
@@ -379,13 +379,8 @@ explicitly denied by the
\fIenv_check\fR \fIenv_check\fR
and and
\fIenv_delete\fR \fIenv_delete\fR
options are options are allowed and their values are
inherited from the invoking process. inherited from the invoking process.
In this case,
\fIenv_check\fR
and
\fIenv_delete\fR
behave like a blacklist.
Prior to version 1.8.21, environment variables with a value beginning with Prior to version 1.8.21, environment variables with a value beginning with
\fR()\fR \fR()\fR
were always removed. were always removed.
@@ -395,7 +390,7 @@ is used to match
\fBbash\fR \fBbash\fR
shell functions instead. shell functions instead.
Since it is not possible Since it is not possible
to blacklist all potentially dangerous environment variables, use to block all potentially dangerous environment variables, use
of the default of the default
\fIenv_reset\fR \fIenv_reset\fR
behavior is encouraged. behavior is encouraged.
@@ -5267,7 +5262,7 @@ Defaults env_keep += "DISPLAY HOME"
# User alias specification # User alias specification
User_Alias FULLTIMERS = millert, mikef, dowdy User_Alias FULLTIMERS = millert, mikef, dowdy
User_Alias PARTTIMERS = bostley, jwfox, crawl User_Alias PARTTIMERS = bostley, jwfox, crawl
User_Alias WEBMASTERS = will, wendy, wim User_Alias WEBADMIN = will, wendy, wim
# Runas alias specification # Runas alias specification
Runas_Alias OP = root, operator Runas_Alias OP = root, operator
@@ -5281,7 +5276,7 @@ Host_Alias SPARC = bigtime, eclipse, moet, anchor :\e
HPPA = boa, nag, python HPPA = boa, nag, python
Host_Alias CUNETS = 128.138.0.0/255.255.0.0 Host_Alias CUNETS = 128.138.0.0/255.255.0.0
Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0 Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
Host_Alias SERVERS = master, mail, www, ns Host_Alias SERVERS = primary, mail, www, ns
Host_Alias CDROM = orion, perseus, hercules Host_Alias CDROM = orion, perseus, hercules
# Cmnd alias specification # Cmnd alias specification
@@ -5605,7 +5600,7 @@ The user
may run any command on any machine except for those in the may run any command on any machine except for those in the
\fISERVERS\fR \fISERVERS\fR
\fRHost_Alias\fR \fRHost_Alias\fR
(master, mail, www and ns). (primary, mail, www and ns).
.nf .nf
.sp .sp
.RS 0n .RS 0n
@@ -5658,12 +5653,12 @@ needs to be able to kill hung processes.
.nf .nf
.sp .sp
.RS 0n .RS 0n
WEBMASTERS www = (www) ALL, (root) /usr/bin/su www WEBADMIN www = (www) ALL, (root) /usr/bin/su www
.RE .RE
.fi .fi
.PP .PP
On the host www, any user in the On the host www, any user in the
\fIWEBMASTERS\fR \fIWEBADMIN\fR
\fRUser_Alias\fR \fRUser_Alias\fR
(will, wendy, and wim), may run any command as user www (which owns the (will, wendy, and wim), may run any command as user www (which owns the
web pages) or simply web pages) or simply

21
doc/sudoers.mdoc.in
View File

@@ -24,7 +24,7 @@
.nr BA @BAMAN@ .nr BA @BAMAN@
.nr LC @LCMAN@ .nr LC @LCMAN@
.nr PS @PSMAN@ .nr PS @PSMAN@
.Dd May 19, 2020 .Dd June 15, 2020
.Dt SUDOERS @mansectform@ .Dt SUDOERS @mansectform@
.Os Sudo @PACKAGE_VERSION@ .Os Sudo @PACKAGE_VERSION@
.Sh NAME .Sh NAME
@@ -369,13 +369,8 @@ explicitly denied by the
.Em env_check .Em env_check
and and
.Em env_delete .Em env_delete
options are options are allowed and their values are
inherited from the invoking process. inherited from the invoking process.
In this case,
.Em env_check
and
.Em env_delete
behave like a blacklist.
Prior to version 1.8.21, environment variables with a value beginning with Prior to version 1.8.21, environment variables with a value beginning with
.Li () .Li ()
were always removed. were always removed.
@@ -385,7 +380,7 @@ is used to match
.Sy bash .Sy bash
shell functions instead. shell functions instead.
Since it is not possible Since it is not possible
to blacklist all potentially dangerous environment variables, use to block all potentially dangerous environment variables, use
of the default of the default
.Em env_reset .Em env_reset
behavior is encouraged. behavior is encouraged.
@@ -4902,7 +4897,7 @@ Defaults env_keep += "DISPLAY HOME"
# User alias specification # User alias specification
User_Alias FULLTIMERS = millert, mikef, dowdy User_Alias FULLTIMERS = millert, mikef, dowdy
User_Alias PARTTIMERS = bostley, jwfox, crawl User_Alias PARTTIMERS = bostley, jwfox, crawl
User_Alias WEBMASTERS = will, wendy, wim User_Alias WEBADMIN = will, wendy, wim
# Runas alias specification # Runas alias specification
Runas_Alias OP = root, operator Runas_Alias OP = root, operator
@@ -4916,7 +4911,7 @@ Host_Alias SPARC = bigtime, eclipse, moet, anchor :\e
HPPA = boa, nag, python HPPA = boa, nag, python
Host_Alias CUNETS = 128.138.0.0/255.255.0.0 Host_Alias CUNETS = 128.138.0.0/255.255.0.0
Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0 Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
Host_Alias SERVERS = master, mail, www, ns Host_Alias SERVERS = primary, mail, www, ns
Host_Alias CDROM = orion, perseus, hercules Host_Alias CDROM = orion, perseus, hercules
# Cmnd alias specification # Cmnd alias specification
@@ -5198,7 +5193,7 @@ The user
may run any command on any machine except for those in the may run any command on any machine except for those in the
.Em SERVERS .Em SERVERS
.Li Host_Alias .Li Host_Alias
(master, mail, www and ns). (primary, mail, www and ns).
.Bd -literal .Bd -literal
jill SERVERS = /usr/bin/, !SU, !SHELLS jill SERVERS = /usr/bin/, !SU, !SHELLS
.Ed .Ed
@@ -5240,11 +5235,11 @@ On his personal workstation, valkyrie,
.Sy matt .Sy matt
needs to be able to kill hung processes. needs to be able to kill hung processes.
.Bd -literal .Bd -literal
WEBMASTERS www = (www) ALL, (root) /usr/bin/su www WEBADMIN www = (www) ALL, (root) /usr/bin/su www
.Ed .Ed
.Pp .Pp
On the host www, any user in the On the host www, any user in the
.Em WEBMASTERS .Em WEBADMIN
.Li User_Alias .Li User_Alias
(will, wendy, and wim), may run any command as user www (which owns the (will, wendy, and wim), may run any command as user www (which owns the
web pages) or simply web pages) or simply

8
examples/sudoers
View File

@@ -20,7 +20,7 @@ Defaults!PAGERS noexec
## ##
User_Alias FULLTIMERS = millert, mikef, dowdy User_Alias FULLTIMERS = millert, mikef, dowdy
User_Alias PARTTIMERS = bostley, jwfox, crawl User_Alias PARTTIMERS = bostley, jwfox, crawl
User_Alias WEBMASTERS = will, wendy, wim User_Alias WEBADMIN = will, wendy, wim
## ##
# Runas alias specification # Runas alias specification
@@ -37,7 +37,7 @@ Host_Alias SPARC = bigtime, eclipse, moet, anchor:\
HPPA = boa, nag, python HPPA = boa, nag, python
Host_Alias CUNETS = 128.138.0.0/255.255.0.0 Host_Alias CUNETS = 128.138.0.0/255.255.0.0
Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0 Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
Host_Alias SERVERS = master, mail, www, ns Host_Alias SERVERS = primary, mail, www, ns
Host_Alias CDROM = orion, perseus, hercules Host_Alias CDROM = orion, perseus, hercules
## ##
@@ -123,10 +123,10 @@ steve CSNETS = (operator) /usr/local/op_commands/
# they get hung. # they get hung.
matt valkyrie = KILL matt valkyrie = KILL
# users in the WEBMASTERS User_Alias (will, wendy, and wim) # users in the WEBADMIN User_Alias (will, wendy, and wim)
# may run any command as user www (which owns the web pages) # may run any command as user www (which owns the web pages)
# or simply su to www. # or simply su to www.
WEBMASTERS www = (www) ALL, (root) /usr/bin/su www WEBADMIN www = (www) ALL, (root) /usr/bin/su www
# anyone can mount/unmount a cd-rom on the machines in the CDROM alias # anyone can mount/unmount a cd-rom on the machines in the CDROM alias
ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\ ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\

8
plugins/sudoers/regress/cvtsudoers/sudoers
View File

@@ -20,7 +20,7 @@ Defaults!PAGERS noexec
## ##
User_Alias FULLTIMERS = millert, mikef, dowdy User_Alias FULLTIMERS = millert, mikef, dowdy
User_Alias PARTTIMERS = bostley, jwfox, crawl User_Alias PARTTIMERS = bostley, jwfox, crawl
User_Alias WEBMASTERS = will, wendy, wim User_Alias WEBADMIN = will, wendy, wim
## ##
# Runas alias specification # Runas alias specification
@@ -37,7 +37,7 @@ Host_Alias SPARC = bigtime, eclipse, moet, anchor:\
HPPA = boa, nag, python HPPA = boa, nag, python
Host_Alias CUNETS = 128.138.0.0/255.255.0.0 Host_Alias CUNETS = 128.138.0.0/255.255.0.0
Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0 Host_Alias CSNETS = 128.138.243.0, 128.138.204.0/24, 128.138.242.0
Host_Alias SERVERS = master, mail, www, ns Host_Alias SERVERS = primary, mail, www, ns
Host_Alias CDROM = orion, perseus, hercules Host_Alias CDROM = orion, perseus, hercules
## ##
@@ -116,10 +116,10 @@ steve CSNETS = (operator) /usr/local/op_commands/
# they get hung. # they get hung.
matt valkyrie = KILL matt valkyrie = KILL
# users in the WEBMASTERS User_Alias (will, wendy, and wim) # users in the WEBADMIN User_Alias (will, wendy, and wim)
# may run any command as user www (which owns the web pages) # may run any command as user www (which owns the web pages)
# or simply su to www. # or simply su to www.
WEBMASTERS www = (www) ALL, (root) /usr/bin/su www WEBADMIN www = (www) ALL, (root) /usr/bin/su www
# anyone can mount/unmount a cd-rom on the machines in the CDROM alias # anyone can mount/unmount a cd-rom on the machines in the CDROM alias
ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\ ALL CDROM = NOPASSWD: /sbin/umount /CDROM,\

2
plugins/sudoers/regress/cvtsudoers/sudoers.defs
View File

@@ -8,7 +8,7 @@ Defaults!PAGERS noexec
User_Alias FULLTIMERS = millert, mikef, dowdy User_Alias FULLTIMERS = millert, mikef, dowdy
User_Alias PARTTIMERS = bostley, jwfox, crawl User_Alias PARTTIMERS = bostley, jwfox, crawl
Host_Alias SERVERS = master, mail, www, ns Host_Alias SERVERS = primary, mail, www, ns
Host_Alias CDROM = orion, perseus, hercules Host_Alias CDROM = orion, perseus, hercules
Cmnd_Alias VIPW = /usr/sbin/vipw, /usr/bin/passwd, /usr/bin/chsh, \ Cmnd_Alias VIPW = /usr/sbin/vipw, /usr/bin/passwd, /usr/bin/chsh, \

2
plugins/sudoers/regress/cvtsudoers/test13.out.ok
View File

@@ -3,5 +3,5 @@ Defaults@SERVERS log_year, logfile=/var/log/sudo.log
Host_Alias CDROM = orion, perseus, hercules Host_Alias CDROM = orion, perseus, hercules
Runas_Alias OPERATOR = operator, backup Runas_Alias OPERATOR = operator, backup
User_Alias PARTTIMERS = bostley, jwfox, crawl User_Alias PARTTIMERS = bostley, jwfox, crawl
Host_Alias SERVERS = master, mail, www, ns Host_Alias SERVERS = primary, mail, www, ns
Cmnd_Alias VIPW = /usr/sbin/vipw, /usr/bin/passwd, /usr/bin/chsh, /usr/bin/chfn Cmnd_Alias VIPW = /usr/sbin/vipw, /usr/bin/passwd, /usr/bin/chsh, /usr/bin/chfn

2
plugins/sudoers/regress/cvtsudoers/test19.out.ok
View File

@@ -6,6 +6,6 @@ Defaults!PAGERS noexec
User_Alias FULLTIMERS = millert, mikef, dowdy User_Alias FULLTIMERS = millert, mikef, dowdy
Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
Host_Alias SERVERS = master, mail, www, ns Host_Alias SERVERS = primary, mail, www, ns
FULLTIMERS ALL = NOPASSWD: ALL FULLTIMERS ALL = NOPASSWD: ALL

2
plugins/sudoers/regress/visudo/test6.sh
View File

@@ -19,7 +19,7 @@ User_Alias FULLTIMERS = millert, mikef, dowdy
Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less Cmnd_Alias PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
Host_Alias SERVERS = master, mail, www, ns Host_Alias SERVERS = primary, mail, www, ns
EOF EOF
exit 0 exit 0