Re: Disallow User switching in Group

On Tue, 16 Nov 2021 11:19:47 +0100, Patrik Peng wrote:

> Is there any way to match all users in group `%sudo-iolog` but restrict
> the `-u` option to the user calling `sudo` without explicitly writing
> the username in the config?

Yes, there is.  The syntax is not obvious but a sudoers rule like:

%sudo-iolog ALL=(:) SETENV: NOPASSWD: LOG_INPUT: LOG_OUTPUT: /bin/bash, /usr/bin/bash, /usr/local/bin/bash

should do the trick.  An empty RunasUser will match the invoking
user.  An empty set of parentheses should also work.  You can verify
this by running "sudo -l" as that user.  The output will expand the
empty RunasUser to the user's login name.

 - todd
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users