Re: sudo -l minimum grants
"Todd C. Miller" <[email protected]>
| Newsgroups | gmane.comp.tools.sudo.user |
|---|---|
| Message-ID | <[email protected]> |
On Tue, 19 Dec 2017 21:28:49 +0100, Daniele Palumbo wrote:
> So to translate it I have to grant at least one command (even not
> existent) to be able to run sudo -l, correct?
Correct. The user (or a group the user belongs to) must be granted
at least one command on the current host. Whether the command
exists or not doesn't matter. You could even do something like:
ALL ALL=/no/such/command
to allow anyone to run a command that doesn't exist. Or for LDAP:
# stub, SUDOers, courtesan.com
dn: cn=stub,ou=SUDOers,dc=courtesan,dc=com
objectClass: top
objectClass: sudoRole
cn: stub
sudoUser: ALL
sudoHost: ALL
sudoCommand: none
> Are the defaults valid as well as definition to be able to run sudo -l?
For file-based sudoers, a per-user Defaults setting is not sufficient
to run "sudo -l" if that is what you mean.
- todd
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users