Bugzilla – Bug 812
Create flag to filter to sudo -l output
Last modified: 2018-05-01 10:20:48 MDT
Currently the output of sudo -l is not parseable out of the box, and contains 3 different sections: - defaults for the host - defaults for the user - command that the user may run on the host Example of sudo -l output is: """ Matching Defaults entries for root on localhost: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, log_output, maxseq=150, iolog_dir=/var/log/sudo-io/%{user}, !requiretty Runas and Command-specific defaults for root: Defaults!/usr/bin/sudoreplay !log_output User root may run the following commands on localhost: (ALL : ALL) ALL """ It would be very useful to have the following flags as optional to "-l": --host-defaults --user-defaults --commands It should be also possible to combinate the options (ie: sudo -l --host-defaults --user-defaults) Example of the expected output: sudo -l --host-defaults """ Matching Defaults entries for root on localhost: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, log_output, maxseq=150, iolog_dir=/var/log/sudo-io/%{user}, !requiretty """ sudo -l --user-defaults """ Runas and Command-specific defaults for root: Defaults!/usr/bin/sudoreplay !log_output """ sudo -l --commands """ User root may run the following commands on localhost: (ALL : ALL) ALL """ sudo -l --host-defaults --user-defaults """ Matching Defaults entries for root on localhost: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, log_output, maxseq=150, iolog_dir=/var/log/sudo-io/%{user}, !requiretty Runas and Command-specific defaults for root: Defaults!/usr/bin/sudoreplay !log_output """
Short fix on the nomenclature, List of options should be --userhost-defaults --specific-defaults --commands Sorry for that.
I think this would be a better fit for cvtsudoers rather than "sudo -l".
Starting with sudo 1.8.23b2, cvtsudoers includes an option to select which type of Defaults to be converted.
In sudo 1.8.23 filtering can be done using cvtsudoers.