Overview
The sudoers file is used to control which commands can be executed by users. It is an important lesson for Linux system administrators.
File Composition
The sudoers file consists of three parts:
- Sudoers default configuration, mainly set some default values of sudo (this article will not introduce these default configurations, if you are interested, you can manually man 5 sudoers and then search defaults)
- Alias (alias) can be regarded as the definition of a variable. This article will also fully discuss the definition of an alias.
- Rule definition: the sudoers file focuses on Rule definition.
Alias has four types of aliases, which can be considered as data types.
- User_Alias
- Runas_Alias
- Host_Alias
- Cmnd_Alias
So how do we define these Alias? Syntax: User_Alias NAME = User_ListRunas_Alias NAME = Runas_ListHost_Alias NAME = Host_ListCmnd_Alias NAME = Cmnd_List the NAME here can be considered as a variable NAME. Note: The NAME must start with an uppercase letter and can only contain uppercase letters, numbers, and underscores. So What Are User_List, Runas_List, Host_List, and Cmnd_List? It is actually an array separated by ",", but the content of the array represented by these four aliases will be different. Now let's take a look at the values of each array element in User_List, Runas_List, Host_List, and Cmnd_List! User: [!] [Username | # uid | % groupname | + netgroup | %: nonunix_group | User_Alias] Runas: [!] [Username | # uid | % groupname | + netgroup | Runas_Alias] Host: [!] [Hostname | ip_addr | network (/netmask )? | Netgroup | Host_Alias] Cmnd: [!] [Commandname | directory | "sudoedit" | Cmnd_Alias] Check the above element name to find out what it means? Here we will discuss some questions that may arise. Exclamation point '! 'Indicates the reverse. Each element can be an alias variable previously defined, so there will be User_List, Runas_List, Host_List, Cmnd_List, and these elements. Directory indicates that you have the permission to access the directory and execute commands. "sudoedit" indicates that you are allowed to use the sudo-e option. If you do not understand it, you can refer to the following alias definition example: User_Alias USER_TEST = tim, #501, % svn, + webgroup, %: nonunix ,! NouserRunas_Alias RUNAS_TEST = tim,# 501, % svn ,! + WebgroupHost_Alias HOST_TEST =! Www.baidu.com, localhost, 127.0.0.1Cmnd _ Alias CMND_TEST = Cmnd_Alias CMDS =/bin/passwd,/bin/ls,/home/svn User Specification (User rule) the syntax defined by User rules is as follows: user_List Host_List = (Runas_List1: Runas_List2) SELinux_Spec Tag_Spec Cmnd_List ,... the preceding syntax is described as follows: User_List (required): which users the rule applies. Host_List (required): indicates the host users that the rule applies. Runas_List1 (optional): indicates the user Runas_List2 (optional) that can be switched using sudo-u: indicates the user group SELinux_Spec that can be switched using sudo-g (optional ): options related to SELinux. The optional values are ROLE = role or TYPE = type. I am not familiar with SELinux. I will try again later. Tag_Spec (optional): it is used to control some options of Cmnd_List. The optional values include the following. Here, let's take a look at your own man.
'Nopasswd: '| 'passwd:' | 'noexec: '| 'exec:' | 'setenv: '| 'nosetenv:' | 'Log _ INPUT: '| 'nolog _ INPUT:' | 'Log _ OUTPUT: '| 'nolog _ OUTPUT :'
... (Optional): indicates the meaning of multiple SELinux_Spec Tag_Spec Cmnd_List segments.
Notice: If Runas_List1 and Runas_List2 are not specified, the default value is run as the root user.
If you don't understand it very well, you can compare it with the example given later in the article. It's hard to be smart!
