Merging multiple files¶

When multiple input files are specified, cvtsudoers will attempt to merge them into a single policy file. It is assumed that user and group names are consistent among the policy files to be merged. For example, user “bob” on one host is the same as user “bob” on another host.

When merging policy files, it is possible to prefix the input file name with a host name, separated by a colon (‘:’). When the files are merged, the host name will be used to restrict the policy rules to that specific host where possible.

The merging process is performed as follows:

•

Each input file is parsed into internal sudoers data structures.

•

Aliases are merged and renamed as necessary to avoid conflicts. In the event of a conflict, the first alias found is left as-is and subsequent aliases of the same name are renamed with a numeric suffix separated with a underscore (‘_’). For example, if there are two different aliases named SERVERS, the first will be left as-is and the second will be renamed SERVERS_1. References to the renamed alias are also updated in the policy file. Duplicate aliases (those with identical contents) are pruned.

•

Defaults settings are merged and duplicates are removed. If there are conflicts in the Defaults settings, a warning is emitted for each conflict. If a host name is specified with the input file, cvtsudoers will change the global Defaults settings in that file to be host-specific. A warning is emitted for command, user, or runas-specific Defaults settings which cannot be made host-specific.

•

Per-user rules are merged and duplicates are removed. If a host name is specified with the input file, cvtsudoers will change rules that specify a host name of ALL to the host name associated with the policy file being merged. The merging of rules is currently fairly simplistic but will be improved in a later release.

It is possible to merge policy files with differing formats.

The cvtsudoers.conf file¶

Options in the form “keyword = value” may also be specified in a configuration file, /etc/cvtsudoers.conf by default. The following keywords are recognized:

defaults = deftypes

See the description of the -d command line option.

expand_aliases = yes | no

See the description of the -e command line option.

group_file = file

See the description of the --group-file command line option.

input_format = ldif | sudoers

See the description of the -i command line option.

match = filter

See the description of the -m command line option.

match_local = yes | no

See the description of the -M command line option.

order_increment = increment

See the description of the -I command line option.

order_start = start_point

See the description of the -O command line option.

output_format = csv | json | ldif | sudoers

See the description of the -f command line option.

padding = padding

See the description of the -P command line option.

passwd_file = file

See the description of the --passwd-file command line option.

prune_matches = yes | no

See the description of the -p command line option.

sudoers_base = dn

See the description of the -b command line option.

suppress = sections

See the description of the -s command line option.

Options on the command line will override values from the configuration file.

JSON output format¶

The sudoers JSON format may contain any of the following top-level objects:

Defaults

An array of objects, each containing an Options array and an optional Binding array.

The Options array consists of one or more objects, each containing a “name:value” pair that corresponds to a sudoers Defaults setting. Options that operate on a list will also include an operation entry in the object, with a value of “list_assign” for ‘=’, “list_add” for ‘+=’, or “list_remove” for ‘-=’.

The optional Binding array consists of one or more objects, each containing a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. If a Binding is present, the setting will only take effect if one of the specified command, hostname, netgroup, networkaddr, nonunixgid, nonunixgroup, usergid, usergroup, userid, username, or alias entries match.

For example, the following sudoers entry:

Defaults@somehost set_home, env_keep += DISPLAY

"Defaults": [


    {


        "Binding": [


            { "hostname": "somehost" }


        ],


        "Options": [


            { "set_home": true },


            {


                "operation": "list_add",


                "env_keep": [


                    "DISPLAY"


                ]


            }


        ]


    }
]

User_Aliases

A JSON object containing one or more sudoers User_Alias entries where each named alias has as its value an array containing one or more objects. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of netgroup, nonunixgid, nonunixgroup, useralias, usergid, usergroup, userid, or username.

For example, the following sudoers entry:

User_Alias SYSADMIN = will, %wheel, +admin

"User_Aliases": {


    "SYSADMIN": [


        { "username": "will" },


        { "usergroup": "wheel" },


        { "netgroup": "admin" }


    ]
}

Runas_Aliases

A JSON object containing one or more sudoers Runas_Alias entries, where each named alias has as its value an array containing one or more objects. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of netgroup, nonunixgid, nonunixgroup, runasalias, usergid, usergroup, userid, or username.

For example, the following sudoers entry:

Runas_Alias DB = oracle, sybase : OP = root, operator

"Runas_Aliases": {


    "DB": [


        { "username": "oracle" },


        { "username": "sybase" }


    ],


    "OP": [


        { "username": "root" },


        { "username": "operator" }


    ]
}

Host_Aliases

A JSON object containing one or more sudoers Host_Alias entries where each named alias has as its value an array containing one or more objects. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of hostalias, hostname, netgroup, or networkaddr.

For example, the following sudoers entries:

Host_Alias DORMNET = 128.138.243.0, 128.138.204.0/24
Host_Alias SERVERS = boulder, refuge

"Host_Aliases": {


    "DORMNET": [


        { "networkaddr": "128.138.243.0" },


        { "networkaddr": "128.138.204.0/24" }


    ],


    "SERVERS": [


        { "hostname": "boulder" },


        { "hostname": "refuge" }


    ]
}

Cmnd_Aliases

A JSON object containing one or more sudoers Cmnd_Alias entries where each named alias has as its value an array containing one or more objects. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be either another cmndalias or a command. For example, the following sudoers entries:

Cmnd_Alias SHELLS = /bin/bash, /bin/csh, /bin/sh, /bin/zsh
Cmnd_Alias VIPW = /usr/bin/chpass, /usr/bin/chfn, /usr/bin/chsh, \


                  /usr/bin/passwd, /usr/sbin/vigr, /usr/sbin/vipw

"Cmnd_Aliases": {


    "SHELLS": [


        { "command": "/bin/bash" },


        { "command": "/bin/csh" },


        { "command": "/bin/sh" },


        { "command": "/bin/zsh" }


    ],


    "VIPW": [


        { "command": "/usr/bin/chpass" },


        { "command": "/usr/bin/chfn" },


        { "command": "/usr/bin/chsh" },


        { "command": "/usr/bin/passwd" },


        { "command": "/usr/sbin/vigr" },


        { "command": "/usr/sbin/vipw" }


    ]
}

User_Specs

A JSON array containing one or more objects, each representing a sudoers User_Spec. Each object in the User_Specs array should contain a User_List array, a Host_List array and a Cmnd_Specs array.

A User_List consists of one or more objects. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of netgroup, nonunixgid, nonunixgroup, useralias, usergid, usergroup, userid, or username. If username is set to the special value ALL, it will match any user.

A Host_List consists of one or more objects. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of hostalias, hostname, netgroup, or networkaddr. If hostname is set to the special value ALL, it will match any host.

The Cmnd_Specs array consists of one or more JSON objects describing a command that may be run. Each Cmnd_Specs is made up of a Commands array, an optional runasusers array, an optional runasgroups array, and an optional Options array.

The Commands array consists of one or more objects containing “name:value” pair elements. The following names and values are supported:

millert ALL = (ALL : ALL) NOPASSWD: ALL, !/usr/bin/id

"User_Specs": [


    {


        "User_List": [


            { "username": "millert" }


        ],


        "Host_List": [


            { "hostname": "ALL" }


        ],


        "Cmnd_Specs": [


            {


                "runasusers": [


                    { "username": "ALL" }


                ],


                "runasgroups": [


                    { "usergroup": "ALL" }


                ],


                "Options": [


                    { "authenticate": false },


                    { "setenv": true }


                ],


                "Commands": [


                    { "command": "ALL" },


                    {


                        "command": "/usr/bin/id",


                        "negated": true


                    }


                ]


            }


        ]


    }
]

CSV output format¶

CSV (comma-separated value) files are often used by spreadsheets and report generators. For CSV output, cvtsudoers double quotes strings that contain commas. For each literal double quote character present inside the string, two double quotes are output. This method of quoting commas is compatible with most spreadsheet programs.

There are three possible sections in cvtsudoers's CSV output, each separated by a blank line:

defaults

This section includes any Defaults settings in sudoers. The defaults section begins with the following heading:

defaults_type,binding,name,operator,value

aliases

This section includes any Cmnd_Alias Host_Alias, Runas_Alias, or User_Alias, entries from sudoers. The aliases section begins with the following heading:

alias_type,alias_name,members

rules

This section includes the sudoers rules that grant privileges. The rules section begins with the following heading:

rule,user,host,runusers,rungroups,options,command

millert ALL = (ALL : ALL) NOPASSWD: ALL, !/usr/bin/id

rule,millert,ALL,ALL,ALL,"!authenticate","ALL,!/usr/bin/id"