The rule that let labops through can be read part by part, and the parts show what it allows and what it does not.
sudo lets a user through according to sudoers rules: lines in /etc/sudoers and in the files of the /etc/sudoers.d directory. The on-call engineer's rule looks like this:
| Part | What it means |
|---|---|
labops |
who is allowed; %name means every member of a group |
ALL= |
which machines the rule applies on — here, any |
(root) |
which account the command may run as |
NOPASSWD: |
without typing one's own password |
/usr/bin/tail -n 2 … |
the command with its arguments, exactly this one; ALL in this place means any |
sudo does not let a call that matches no rule through without a password: that is why labops saw a password is required. sudo -l shows your own rules, and sudo -l -U name shows someone else's:
You have two rules: (ALL : ALL) ALL comes from the line %sudo ALL=(ALL:ALL) ALL in /etc/sudoers — you are in the sudo group — and (ALL) NOPASSWD: ALL from the file /etc/sudoers.d/90-student.
Do not allow shells, editors, or scripts the grantee can rewrite through sudo: in vim run as root, :!sh opens a root shell, and a rewritten script will do anything.
/etc/sudoers has the line %sudo ALL=(ALL:ALL) ALL. The user deploy was added to the sudo group. What does he get?
-
%sudoat the start of the line is who is allowed: every member of the group. The lastALLsets the commands: any. -
The
%sudoline already applies to every member of the group. After the change,sudo -l -U deployshows(ALL : ALL) ALL. -
sudo neither hands out nor asks for the root password: a group member types his own, and this line has no
NOPASSWD.
%sudo is every member of the sudo group, (ALL:ALL) is as any user and group, and the last ALL is any command. There is no NOPASSWD, so sudo asks deploy for his own password.
Key points
- A sudoers rule says who, on which machine, as which account, and which command with which arguments.
-
A call that matches no rule does not go through;
sudo -l -U nameshows a user's rules.