A rule is tested as the person it was given to, from both sides: the allowed call works, and the neighbouring ones do not.
sudo -l -U name shows what came out of all the files together. Then come the calls: sudo -u name sudo -n command for the allowed command and for a neighbouring one — another argument, another file, another program. You do not test this as student: student's own rules allow everything, so there would be no refusal.
Allow one command
The on-call engineer labops needs to see the tail of the application log. Let him run exactly /usr/bin/tail -n 20 /srv/sudo-lab/app.log as root without a password, and nothing else. Put the rule in /etc/sudoers.d/labops; the whole sudo configuration must pass the check.
Goals · 0 of 3
- Allow labops one tail call as root not done yet
- Keep everything else forbidden not done yet
- Keep the sudo configuration valid not done yet