diff options
| author | Stephen Hemminger <stephen.hemminger@vyatta.com> | 2009-03-03 14:30:37 -0800 |
|---|---|---|
| committer | Stephen Hemminger <stephen.hemminger@vyatta.com> | 2009-03-03 14:30:37 -0800 |
| commit | 1ebbd6378f63a18e69e196f0ba43b43c1a0df39c (patch) | |
| tree | 7f0f03df9e1f9e440c1afc938b95cf91195605d4 | |
| parent | 47b6beb04513eb619454fb6cae2fb7470f699996 (diff) | |
| download | vyatta-cfg-quagga-1ebbd6378f63a18e69e196f0ba43b43c1a0df39c.tar.gz vyatta-cfg-quagga-1ebbd6378f63a18e69e196f0ba43b43c1a0df39c.zip | |
Change sudo ability of some operator related commands
Bug 4147, 4142
Don't allow arbitrary conntrack commands
Do allow operator to show disk format.
| -rw-r--r-- | debian/vyatta-cfg-system.postinst.in | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/debian/vyatta-cfg-system.postinst.in b/debian/vyatta-cfg-system.postinst.in index c83e687e..0f2b8907 100644 --- a/debian/vyatta-cfg-system.postinst.in +++ b/debian/vyatta-cfg-system.postinst.in @@ -60,6 +60,9 @@ Cmnd_Alias IPTABLES = /sbin/iptables --list -n,\ /sbin/iptables -t * -Z * Cmnd_Alias IP6TABLES = /sbin/ip6tables -t * -Z *, \ /sbin/ip6tables -t * -L * +Cmnd_Alias CONNTRACK = /usr/sbin/conntrack -L *, \ + /usr/sbin/conntrack -G *, \ + /usr/sbin/conntrack -E * Cmnd_Alias IPFLUSH = /sbin/ip route flush cache, \ /sbin/ip route flush cache *,\ /sbin/ip neigh flush to *, \ @@ -73,12 +76,13 @@ Cmnd_Alias ETHTOOL = /usr/sbin/ethtool -p *, \ /usr/sbin/ethtool -a *, \ /usr/sbin/ethtool -c *, \ /usr/sbin/ethtool -i * +Cmnd_Alias DISK = /sbin/lsof, /sbin/fdisk -l *, /sbin/sfdisk -d * Cmnd_Alias DATE = /bin/date, /usr/sbin/ntpdate Cmnd_Alias PPPOE_CMDS = /sbin/pppd, /sbin/poff, /usr/sbin/pppstats Cmnd_Alias PCAPTURE = /usr/bin/tshark, /usr/bin/tcpdump %operator ALL=NOPASSWD: DATE, IPTABLES, ETHTOOL, IPFLUSH, \ PPPOE_CMDS, PCAPTURE, /usr/sbin/wanpipemon, \ - /usr/bin/lsof, /usr/sbin/conntrack, IP6TABLES + DISK, CONNTRACK, IP6TABLES EOF cat <<EOF >>/etc/sudoers %users ALL=NOPASSWD: ${bindir}/sudo-users/ |