Edit File: sudoers.aug
(* Module: Sudoers Parses /etc/sudoers Author: Raphael Pinson <raphink@gmail.com> About: Reference This lens tries to keep as close as possible to `man sudoers` where possible. For example, recursive definitions such as > Cmnd_Spec_List ::= Cmnd_Spec | > Cmnd_Spec ',' Cmnd_Spec_List are replaced by > let cmnd_spec_list = cmnd_spec . ( sep_com . cmnd_spec )* since Augeas cannot deal with recursive definitions. The definitions from `man sudoers` are put as commentaries for reference throughout the file. More information can be found in the manual. About: License This file is licensed under the LGPL v2+, like the rest of Augeas. About: Lens Usage Sample usage of this lens in augtool * Set first Defaults to apply to the "LOCALNET" network alias > set /files/etc/sudoers/Defaults[1]/type "@LOCALNET" * List all user specifications applying explicitely to the "admin" Unix group > match /files/etc/sudoers/spec/user "%admin" * Remove the full 3rd user specification > rm /files/etc/sudoers/spec[3] About: Configuration files This lens applies to /etc/sudoers. See <filter>. *) module Sudoers = autoload xfm (************************************************************************ * Group: USEFUL PRIMITIVES *************************************************************************) (* Group: Generic primitives *) (* Variable: eol *) let eol = Util.eol (* Variable: indent *) let indent = Util.indent (* Group: Separators *) (* Variable: sep_spc *) let sep_spc = Sep.space (* Variable: sep_cont *) let sep_cont = Sep.cl_or_space (* Variable: sep_cont_opt *) let sep_cont_opt = Sep.cl_or_opt_space (* Variable: sep_cont_opt_build *) let sep_cont_opt_build (sep:string) = del (Rx.cl_or_opt_space . sep . Rx.cl_or_opt_space) (" " . sep . " ") (* Variable: sep_com *) let sep_com = sep_cont_opt_build "," (* Variable: sep_eq *) let sep_eq = sep_cont_opt_build "=" (* Variable: sep_col *) let sep_col = sep_cont_opt_build ":" (* Variable: sep_dquote *) let sep_dquote = Util.del_str "\"" (* Group: Stores *) (* Variable: sto_to_com_cmnd sto_to_com_cmnd does not begin or end with a space *) let sto_to_com_cmnd = let alias = Rx.word - /(NO)?(PASSWD|EXEC|SETENV)/ in let non_alias = /(!?[\/a-z]([^,:#()\n\\]|\\\\[=:,\\])*[^,=:#() \t\n\\])|[^,=:#() \t\n\\]/ in store (alias | non_alias) (* Variable: sto_to_com There could be a \ in the middle of a command *) let sto_to_com = store /([^,=:#() \t\n\\][^,=:#()\n]*[^,=:#() \t\n\\])|[^,=:#() \t\n\\]/ (* Variable: sto_to_com_host *) let sto_to_com_host = store /[^,=:#() \t\n\\]+/ (* Variable: sto_to_com_user Escaped spaces and NIS domains and allowed*) let sto_to_com_user = let nis_re = /([A-Z]([-A-Z0-9]|(\\\\[ \t]))*+\\\\\\\\)/ in let user_re = /[%+@a-z]([-A-Za-z0-9._+]|(\\\\[ \t]))*/ in let alias_re = /[A-Z_]+/ in store ((nis_re? . user_re) | alias_re) (* Variable: to_com_chars *) let to_com_chars = /[^",=#() \t\n\\]+/ (* " relax emacs *) (* Variable: to_com_dquot *) let to_com_dquot = /"[^",=#()\n\\]+"/ (* " relax emacs *) (* Variable: sto_to_com_dquot *) let sto_to_com_dquot = store (to_com_chars|to_com_dquot) (* Variable: sto_to_com_col *) let sto_to_com_col = store to_com_chars (* Variable: sto_to_eq *) let sto_to_eq = store /[^,=:#() \t\n\\]+/ (* Variable: sto_to_spc *) let sto_to_spc = store /[^", \t\n\\]+|"[^", \t\n\\]+"/ (* Variable: sto_to_spc_no_dquote *) let sto_to_spc_no_dquote = store /[^",# \t\n\\]+/ (* " relax emacs *) (* Variable: sto_integer *) let sto_integer = store /[0-9]+/ (* Group: Comments and empty lines *) (* View: comment Map comments in "#comment" nodes *) let comment = let sto_to_eol = store (/([^ \t\n].*[^ \t\n]|[^ \t\n])/ - /include(dir)?.*/) in [ label "#comment" . del /[ \t]*#[ \t]*/ "# " . sto_to_eol . eol ] (* View: comment_eol Requires a space before the # *) let comment_eol = Util.comment_generic /[ \t]+#[ \t]*/ " # " (* View: comment_or_eol A <comment_eol> or <eol> *) let comment_or_eol = comment_eol | (del /([ \t]+#\n|[ \t]*\n)/ "\n") (* View: empty Map empty lines *) let empty = [ del /[ \t]*#?[ \t]*\n/ "\n" ] (* View: includedir *) let includedir = [ key /#include(dir)?/ . Sep.space . store Rx.fspath . eol ] (************************************************************************ * Group: ALIASES *************************************************************************) (************************************************************************ * View: alias_field * Generic alias field to gather all Alias definitions * * Definition: * > User_Alias ::= NAME '=' User_List * > Runas_Alias ::= NAME '=' Runas_List * > Host_Alias ::= NAME '=' Host_List * > Cmnd_Alias ::= NAME '=' Cmnd_List * * Parameters: * kw:string - the label string * sto:lens - the store lens *************************************************************************) let alias_field (kw:string) (sto:lens) = [ label kw . sto ] (* View: alias_list List of <alias_fields>, separated by commas *) let alias_list (kw:string) (sto:lens) = Build.opt_list (alias_field kw sto) sep_com (************************************************************************ * View: alias_name * Name of an <alias_entry_single> * * Definition: * > NAME ::= [A-Z]([A-Z][0-9]_)* *************************************************************************) let alias_name = [ label "name" . store /[A-Z][A-Z0-9_]*/ ] (************************************************************************ * View: alias_entry_single * Single <alias_entry>, named using <alias_name> and listing <alias_list> * * Definition: * > Alias_Type NAME = item1, item2, ... * * Parameters: * field:string - the field name, passed to <alias_list> * sto:lens - the store lens, passed to <alias_list> *************************************************************************) let alias_entry_single (field:string) (sto:lens) = [ label "alias" . alias_name . sep_eq . alias_list field sto ] (************************************************************************ * View: alias_entry * Alias entry, a list of comma-separated <alias_entry_single> fields * * Definition: * > Alias_Type NAME = item1, item2, item3 : NAME = item4, item5 * * Parameters: * kw:string - the alias keyword string * field:string - the field name, passed to <alias_entry_single> * sto:lens - the store lens, passed to <alias_entry_single> *************************************************************************) let alias_entry (kw:string) (field:string) (sto:lens) = [ indent . key kw . sep_cont . alias_entry_single field sto . ( sep_col . alias_entry_single field sto )* . comment_or_eol ] (* TODO: go further in user definitions *) (* View: user_alias User_Alias, see <alias_field> *) let user_alias = alias_entry "User_Alias" "user" sto_to_com (* View: runas_alias Run_Alias, see <alias_field> *) let runas_alias = alias_entry "Runas_Alias" "runas_user" sto_to_com (* View: host_alias Host_Alias, see <alias_field> *) let host_alias = alias_entry "Host_Alias" "host" sto_to_com (* View: cmnd_alias Cmnd_Alias, see <alias_field> *) let cmnd_alias = alias_entry "Cmnd_Alias" "command" sto_to_com_cmnd (************************************************************************ * View: alias * Every kind of Alias entry, * see <user_alias>, <runas_alias>, <host_alias> and <cmnd_alias> * * Definition: * > Alias ::= 'User_Alias' User_Alias (':' User_Alias)* | * > 'Runas_Alias' Runas_Alias (':' Runas_Alias)* | * > 'Host_Alias' Host_Alias (':' Host_Alias)* | * > 'Cmnd_Alias' Cmnd_Alias (':' Cmnd_Alias)* *************************************************************************) let alias = user_alias | runas_alias | host_alias | cmnd_alias (************************************************************************ * Group: DEFAULTS *************************************************************************) (************************************************************************ * View: default_type * Type definition for <defaults> * * Definition: * > Default_Type ::= 'Defaults' | * > 'Defaults' '@' Host_List | * > 'Defaults' ':' User_List | * > 'Defaults' '!' Cmnd_List | * > 'Defaults' '>' Runas_List *************************************************************************) let default_type = let value = store /[@:!>][^ \t\n\\]+/ in [ label "type" . value ] (************************************************************************ * View: del_negate * Delete an even number of '!' signs *************************************************************************) let del_negate = del /(!!)*/ "" (************************************************************************ * View: negate_node * Negation of boolean values for <defaults>. Accept one optional '!' * and produce a 'negate' node if there is one. *************************************************************************) let negate_node = [ del "!" "!" . label "negate" ] let negate_or_value (key:lens) (value:lens) = [ del_negate . (negate_node . key | key . value) ] (************************************************************************ * View: parameter_flag * A flag parameter for <defaults> * * Flags are implicitly boolean and can be turned off via the '!' operator. * Some integer, string and list parameters may also be used in a boolean * context to disable them. *************************************************************************) let parameter_flag_kw = "always_set_home" | "authenticate" | "env_editor" | "env_reset" | "fqdn" | "ignore_dot" | "ignore_local_sudoers" | "insults" | "log_host" | "log_year" | "long_otp_prompt" | "mail_always" | "mail_badpass" | "mail_no_host" | "mail_no_perms" | "mail_no_user" | "noexec" | "path_info" | "passprompt_override" | "preserve_groups" | "requiretty" | "root_sudo" | "rootpw" | "runaspw" | "set_home" | "set_logname" | "setenv" | "shell_noargs" | "stay_setuid" | "targetpw" | "tty_tickets" | "visiblepw" | "closefrom_override" | "closefrom_override" | "compress_io" | "fast_glob" | "log_input" | "log_output" | "pwfeedback" | "umask_override" | "use_pty" | "match_group_by_gid" | "always_query_group_plugin" let parameter_flag = [ del_negate . negate_node? . key parameter_flag_kw ] (************************************************************************ * View: parameter_integer * An integer parameter for <defaults> *************************************************************************) let parameter_integer_nobool_kw = "passwd_tries" let parameter_integer_nobool = [ key parameter_integer_nobool_kw . sep_eq . del /"?/ "" . sto_integer . del /"?/ "" ] let parameter_integer_bool_kw = "loglinelen" | "passwd_timeout" | "timestamp_timeout" | "umask" let parameter_integer_bool = negate_or_value (key parameter_integer_bool_kw) (sep_eq . del /"?/ "" . sto_integer . del /"?/ "") let parameter_integer = parameter_integer_nobool | parameter_integer_bool (************************************************************************ * View: parameter_string * A string parameter for <defaults> * * An odd number of '!' operators negate the value of the item; * an even number just cancel each other out. *************************************************************************) let parameter_string_nobool_kw = "badpass_message" | "editor" | "mailsub" | "noexec_file" | "passprompt" | "runas_default" | "syslog_badpri" | "syslog_goodpri" | "timestampdir" | "timestampowner" | "secure_path" let parameter_string_nobool = [ key parameter_string_nobool_kw . sep_eq . sto_to_com_dquot ] let parameter_string_bool_kw = "exempt_group" | "lecture" | "lecture_file" | "listpw" | "logfile" | "mailerflags" | "mailerpath" | "mailto" | "mailfrom" | "syslog" | "verifypw" let parameter_string_bool = negate_or_value (key parameter_string_bool_kw) (sep_eq . sto_to_com_dquot) let parameter_string = parameter_string_nobool | parameter_string_bool (************************************************************************ * View: parameter_lists * A single list parameter for <defaults> * * All lists can be used in a boolean context * The argument may be a double-quoted, space-separated list or a single * value without double-quotes. * The list can be replaced, added to, deleted from, or disabled * by using the =, +=, -=, and ! operators respectively. * An odd number of '!' operators negate the value of the item; * an even number just cancel each other out. *************************************************************************) let parameter_lists_kw = "env_check" | "env_delete" | "env_keep" let parameter_lists_value = [ label "var" . sto_to_spc_no_dquote ] let parameter_lists_value_dquote = [ label "var" . del /"?/ "" . sto_to_spc_no_dquote . del /"?/ "" ] let parameter_lists_values = parameter_lists_value_dquote | ( sep_dquote . parameter_lists_value . ( sep_cont . parameter_lists_value )+ . sep_dquote ) let parameter_lists_sep = sep_cont_opt . ( [ del "+" "+" . label "append" ] | [ del "-" "-" . label "remove" ] )? . del "=" "=" . sep_cont_opt let parameter_lists = negate_or_value (key parameter_lists_kw) (parameter_lists_sep . parameter_lists_values) (************************************************************************ * View: parameter * A single parameter for <defaults> * * Definition: * > Parameter ::= Parameter '=' Value | * > Parameter '+=' Value | * > Parameter '-=' Value | * > '!'* Parameter * * Parameters may be flags, integer values, strings, or lists. * *************************************************************************) let parameter = parameter_flag | parameter_integer | parameter_string | parameter_lists (************************************************************************ * View: parameter_list * A list of comma-separated <parameters> for <defaults> * * Definition: * > Parameter_List ::= Parameter | * > Parameter ',' Parameter_List *************************************************************************) let parameter_list = parameter . ( sep_com . parameter )* (************************************************************************ * View: defaults * A Defaults entry * * Definition: * > Default_Entry ::= Default_Type Parameter_List *************************************************************************) let defaults = [ indent . key "Defaults" . default_type? . sep_cont . parameter_list . comment_or_eol ] (************************************************************************ * Group: USER SPECIFICATION *************************************************************************) (************************************************************************ * View: runas_spec * A runas specification for <spec>, using <alias_list> for listing * users and/or groups used to run a command * * Definition: * > Runas_Spec ::= '(' Runas_List ')' | * > '(:' Runas_List ')' | * > '(' Runas_List ':' Runas_List ')' *************************************************************************) let runas_spec_user = alias_list "runas_user" sto_to_com let runas_spec_group = Util.del_str ":" . indent . alias_list "runas_group" sto_to_com let runas_spec_usergroup = runas_spec_user . indent . runas_spec_group let runas_spec = Util.del_str "(" . (runas_spec_user | runas_spec_group | runas_spec_usergroup ) . Util.del_str ")" . sep_cont_opt (************************************************************************ * View: tag_spec * Tag specification for <spec> * * Definition: * > Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' | * > 'SETENV:' | 'NOSETENV:') *************************************************************************) let tag_spec = [ label "tag" . store /(NO)?(PASSWD|EXEC|SETENV)/ . sep_col ] (************************************************************************ * View: cmnd_spec * Command specification for <spec>, * with optional <runas_spec> and any amount of <tag_specs> * * Definition: * > Cmnd_Spec ::= Runas_Spec? Tag_Spec* Cmnd *************************************************************************) let cmnd_spec = [ label "command" . runas_spec? . tag_spec* . sto_to_com_cmnd ] (************************************************************************ * View: cmnd_spec_list * A list of comma-separated <cmnd_specs> * * Definition: * > Cmnd_Spec_List ::= Cmnd_Spec | * > Cmnd_Spec ',' Cmnd_Spec_List *************************************************************************) let cmnd_spec_list = Build.opt_list cmnd_spec sep_com (************************************************************************ * View: spec_list * Group of hosts with <cmnd_spec_list> *************************************************************************) let spec_list = [ label "host_group" . alias_list "host" sto_to_com_host . sep_eq . cmnd_spec_list ] (************************************************************************ * View: spec * A user specification, listing colon-separated <spec_lists> * * Definition: * > User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \ * > (':' Host_List '=' Cmnd_Spec_List)* *************************************************************************) let spec = [ label "spec" . indent . alias_list "user" sto_to_com_user . sep_cont . Build.opt_list spec_list sep_col . comment_or_eol ] (************************************************************************ * Group: LENS & FILTER *************************************************************************) (* View: lns The sudoers lens, any amount of * <empty> lines * <comments> * <includedirs> * <aliases> * <defaults> * <specs> *) let lns = ( empty | comment | includedir | alias | defaults | spec )* (* View: filter *) let filter = (incl "/etc/sudoers") . (incl "/usr/local/etc/sudoers") . (incl "/etc/sudoers.d/*") . (incl "/usr/local/etc/sudoers.d/*") . (incl "/opt/csw/etc/sudoers") . (incl "/etc/opt/csw/sudoers") . Util.stdexcl let xfm = transform lns filter