Sudoers: when multiple entries match

I had a minor interpretation issue with a paragraph in the Sudoers Manual. So I wrote to the sudo mailinglist and asked a clarification... Here is their answer, which made perfect sense! Thanks!


Let's say you have a user, bob, who is a member of a group and sudo has a configuration like:
User_Alias ADMINS=bob,mike,tom
ADMINS ALL = (ALL) PASSWD: /bin/ps, /bin/ls, /usr/sbin/shutdown -y -g0 -i0
bob ALL = (ALL) PASSWD: /usr/sbin/shutdown


This says that bob has multiple entries (in the group and an explicit entry) but the rules say that his last match contradicts the ADMINS. It will give his last match... i.e., he can use shutdown with any argument... if you reverse these entries:
bob ALL = (ALL) PASSWD: /usr/sbin/shutdown
ADMINS ALL = (ALL) PASSWD: /bin/ps, /bin/ls, /usr/sbin/shutdown -y -g0 -i0

then you have effectively restricted bob to the same command as the other admins. and therefore not given him any special treatment...

No comments: