Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

nixos/sudo: default rule should be first #87579

Merged
merged 1 commit into from Jun 18, 2020
Merged

nixos/sudo: default rule should be first #87579

merged 1 commit into from Jun 18, 2020

Conversation

@cole-h
Copy link
Member

cole-h commented May 11, 2020

In /etc/sudoers, the last-matched rule will override all
previously-matched rules. Thus, make the default rule show up first (but
still allow some wiggle room for a user to mkBefore it), before any
user-defined rules.

Motivation for this change

Addresses #87555. I'll backport this to 20.03 after this gets merged (or whoever merges this can take care of that for me; I don't mind either way, but that might be easier than waiting for me to follow up).

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.
@lschuermann
Copy link
Member

lschuermann commented May 11, 2020

@GrahamcOfBorg test sudo

@veprbl veprbl linked an issue that may be closed by this pull request May 11, 2020
Copy link
Member

lschuermann left a comment

Looks good. Handling sudo rules is tricky, this achieves the expected behavior.

@emilazy
Copy link
Member

emilazy commented May 18, 2020

Could something be added to the test for this, say by setting extraRules to something that overrides the default and checking that sudo(1) behaves accordingly?

@cole-h
Copy link
Member Author

cole-h commented Jun 18, 2020

If somebody more familiar with sudo and its configuration would like to write that test case in a follow-up, I'd be delighted. I tried my hand at it and failed, but I'd like to get this merged sooner rather than later so as to resolve the linked issue.

Sorry it took me so long to get back to this (and even sorrier that it was just to say "I can't do that").

In /etc/sudoers, the last-matched rule will override all
previously-matched rules. Thus, make the default rule show up first (but
still allow some wiggle room for a user to `mkBefore` it), before any
user-defined rules.
@cole-h cole-h force-pushed the cole-h:sudo branch from 55855bb to 13e2c75 Jun 18, 2020
@worldofpeace worldofpeace merged commit d7122c3 into NixOS:master Jun 18, 2020
0 of 2 checks passed
0 of 2 checks passed
grahamcofborg-eval Beginning Evaluations
Details
grahamcofborg-eval-package-list nix-env -qa --json --file .
Details
@cole-h cole-h deleted the cole-h:sudo branch Jun 18, 2020
@cole-h cole-h mentioned this pull request Jun 18, 2020
1 of 10 tasks complete
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

6 participants
You can’t perform that action at this time.