Re: What is the opposite of ALL?

On Tue, 16 Nov 2021 11:24:41 -0700, Grant Taylor via sudo-users wrote:

> What is the opposite of ALL in the command list in following rule?
>
>     %group ALL = (ALL) ALL
>
> My kneejerk reaction is to use the following.
>
>     %group ALL = (ALL) !ALL
>
> But "!ALL" seems ... wrong to me.

You are correct, "!ALL" is what you are looking for even if it looks
a bit "funny".

> Yes, I know the dangers of negation.  I'm trying to set a safety net /0
> trap for a legacy group that's no longer being used after a migration to
> a new group.
>
>     %oldgroup ALL = (ALL) !ALL
>     %newgroup ALL = (ALL) NewGroupCommands
>
> My intention is to cause a hard / fast failure if ID Administration
> inadvertently adds new users to the old group instead of the new group.

That should do what you want.  Order is important here since the
last rule wins but I think you understand that.

 - todd
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users