Bug 812 - Create flag to filter to sudo -l output
Create flag to filter to sudo -l output
Status: RESOLVED FIXED
Product: Sudo
Classification: Unclassified
Component: Sudo
1.8.21
All All
: low enhancement
Assigned To: Todd C. Miller
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-12-06 17:01 MST by Daniele Palumbo
Modified: 2018-05-01 10:20 MDT (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Daniele Palumbo 2017-12-06 17:01:28 MST
Currently the output of sudo -l is not parseable out of the box, and contains 3 different sections:
- defaults for the host
- defaults for the user
- command that the user may run on the host

Example of sudo -l output is:
"""
Matching Defaults entries for root on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, log_output, maxseq=150,
    iolog_dir=/var/log/sudo-io/%{user}, !requiretty

Runas and Command-specific defaults for root:
    Defaults!/usr/bin/sudoreplay !log_output

User root may run the following commands on localhost:
    (ALL : ALL) ALL
"""

It would be very useful to have the following flags as optional to "-l":
--host-defaults
--user-defaults
--commands

It should be also possible to combinate the options (ie: sudo -l --host-defaults --user-defaults)

Example of the expected output:

sudo -l --host-defaults
"""
Matching Defaults entries for root on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, log_output, maxseq=150,
    iolog_dir=/var/log/sudo-io/%{user}, !requiretty
"""


sudo -l --user-defaults
"""
Runas and Command-specific defaults for root:
    Defaults!/usr/bin/sudoreplay !log_output
"""

sudo -l --commands
"""
User root may run the following commands on localhost:
    (ALL : ALL) ALL
"""

sudo -l --host-defaults --user-defaults
"""
Matching Defaults entries for root on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, log_output, maxseq=150,
    iolog_dir=/var/log/sudo-io/%{user}, !requiretty

Runas and Command-specific defaults for root:
    Defaults!/usr/bin/sudoreplay !log_output
"""
Comment 1 Daniele Palumbo 2017-12-06 17:20:42 MST
Short fix on the nomenclature,

List of options should be
--userhost-defaults
--specific-defaults
--commands

Sorry for that.
Comment 2 Todd C. Miller 2018-03-27 16:40:44 MDT
I think this would be a better fit for cvtsudoers rather than "sudo -l".
Comment 3 Todd C. Miller 2018-03-30 07:04:04 MDT
Starting with sudo 1.8.23b2, cvtsudoers includes an option to select which type of Defaults to be converted.
Comment 4 Todd C. Miller 2018-05-01 10:20:48 MDT
In sudo 1.8.23 filtering can be done using cvtsudoers.