Skip to content

sudo: install validated drop-ins instead of editing /etc/sudoers #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
presto8 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

sudo: install validated drop-ins instead of editing /etc/sudoers #27

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 31 additions & 5 deletions setup
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,19 +177,45 @@ install_pscripts() {
done
}

enable_sudo_without_password() {
if ! sudo grep -q NOPASSWD /etc/sudoers; then
: Allow sudo without password
sudo sed -E -i.bak 's|^(%sudo.+ALL:ALL\)) (ALL)|\1 NOPASSWD:SETENV: \2|' /etc/sudoers
_install_sudoers_snippet() {
: "_install_sudoers_snippet <name> <line>... -- validates before installing"
local name=$1 tmp
shift

if ! sudo grep -qE '^[@#]includedir[[:space:]]+/etc/sudoers.d' /etc/sudoers; then
die "/etc/sudoers does not include /etc/sudoers.d; refusing to edit sudoers"
Comment on lines +185 to +186
fi

tmp=$(mktemp)
printf '%s\n' "$@" >"$tmp"

# Never install a sudoers file we have not parsed: a syntax error in
# /etc/sudoers.d locks the machine out of sudo entirely.
if ! sudo visudo -cf "$tmp" >/dev/null; then
rm -f "$tmp"
die "generated sudoers snippet '$name' is invalid; not installing"
fi

sudo install -o root -g root -m 0440 "$tmp" "/etc/sudoers.d/$name"
rm -f "$tmp"
Comment on lines +199 to +200
}

enable_sudo_without_password() {
: Allow sudo without password
# SETENV is required for the "sudo -E" calls elsewhere in this script
_install_sudoers_snippet prestobuntu-nopasswd \
'# Managed by prestobuntu' \
'%sudo ALL=(ALL:ALL) NOPASSWD:SETENV: ALL'
}

remove_sudo_warning() {
touch "$HOME/.sudo_as_admin_successful"
}

pass_http_thru_sudo() {
_require_line 'Defaults:%sudo env_keep += "http_proxy https_proxy"' /etc/sudoers
_install_sudoers_snippet prestobuntu-proxy \
'# Managed by prestobuntu' \
'Defaults:%sudo env_keep += "http_proxy https_proxy"'
}

setup_ssh() {
Expand Down