Closed jaymzh closed 11 months ago
Migrate scale_sudo -> fb_sudo; fix dd-agent postix sudo access
Summary:
scale_sudo
fb_sudo
Closes #296
Test Plan:
Taste-tested and got...
--- /etc/sudoers 2023-08-23 03:51:04.724300851 +0000 +++ /tmp/.chef-sudoers20231012-3840474-6rscpw 2023-10-12 01:34:29.864507596 +0000 @@ -1,14 +1,25 @@ # This file is managed by Chef -Defaults !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path = /sbin:/bin:/usr/sbin:/usr/bin +Defaults !visiblepw +Defaults always_set_home +Defaults env_reset +Defaults env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY" +Defaults secure_path="/sbin:/bin:/usr/sbin:/usr/bin" + # Host aliases # User aliases +# User aliases + # Command aliases # Users +## all +%sudo ALL=(ALL) ALL +## admins can run anything %sudo ALL=NOPASSWD: ALL -dd-agent ALL=(ALL) NOPASSWD:/usr/bin/find /var/spool/postfix/ -type f, /bin/find /var/spool/postfix/ -type f +## postfix +dd-agent ALL=(ALL) NOPASSWD:/usr/bin/find /var/spool/postfix/incoming -type f - Would restore selinux security context
plus:
Oct 12 01:53:01 scale-lists2 sudo[3846097]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=list Oct 12 01:53:01 scale-lists2 sudo[3846099]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/find /var/spool/postfix/deferred -type f Oct 12 01:53:01 scale-lists2 sudo[3846099]: pam_unix(sudo:session): session opened for user root by (uid=0) Oct 12 01:53:01 scale-lists2 sudo[3846099]: pam_unix(sudo:session): session closed for user root Oct 12 01:53:16 scale-lists2 sudo[3846152]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=list Oct 12 01:53:16 scale-lists2 sudo[3846154]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/find /var/spool/postfix/incoming -type f Oct 12 01:53:16 scale-lists2 sudo[3846154]: pam_unix(sudo:session): session opened for user root by (uid=0) Oct 12 01:53:16 scale-lists2 sudo[3846154]: pam_unix(sudo:session): session closed for user root Oct 12 01:53:16 scale-lists2 sudo[3846168]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=list Oct 12 01:53:16 scale-lists2 sudo[3846171]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/find /var/spool/postfix/active -type f Oct 12 01:53:16 scale-lists2 sudo[3846171]: pam_unix(sudo:session): session opened for user root by (uid=0) Oct 12 01:53:16 scale-lists2 sudo[3846171]: pam_unix(sudo:session): session closed for user root Oct 12 01:53:16 scale-lists2 sudo[3846175]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=list Oct 12 01:53:16 scale-lists2 sudo[3846177]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/find /var/spool/postfix/deferred -type f
Migrate scale_sudo -> fb_sudo; fix dd-agent postix sudo access
Summary:
scale_sudo
, our hacky solution beforefb_sudo
was opensourced, tofb_sudo
Closes #296
Test Plan:
Taste-tested and got...
plus: