From 1ebbd6378f63a18e69e196f0ba43b43c1a0df39c Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Tue, 3 Mar 2009 14:30:37 -0800 Subject: Change sudo ability of some operator related commands Bug 4147, 4142 Don't allow arbitrary conntrack commands Do allow operator to show disk format. --- debian/vyatta-cfg-system.postinst.in | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/debian/vyatta-cfg-system.postinst.in b/debian/vyatta-cfg-system.postinst.in index c83e687e..0f2b8907 100644 --- a/debian/vyatta-cfg-system.postinst.in +++ b/debian/vyatta-cfg-system.postinst.in @@ -60,6 +60,9 @@ Cmnd_Alias IPTABLES = /sbin/iptables --list -n,\ /sbin/iptables -t * -Z * Cmnd_Alias IP6TABLES = /sbin/ip6tables -t * -Z *, \ /sbin/ip6tables -t * -L * +Cmnd_Alias CONNTRACK = /usr/sbin/conntrack -L *, \ + /usr/sbin/conntrack -G *, \ + /usr/sbin/conntrack -E * Cmnd_Alias IPFLUSH = /sbin/ip route flush cache, \ /sbin/ip route flush cache *,\ /sbin/ip neigh flush to *, \ @@ -73,12 +76,13 @@ Cmnd_Alias ETHTOOL = /usr/sbin/ethtool -p *, \ /usr/sbin/ethtool -a *, \ /usr/sbin/ethtool -c *, \ /usr/sbin/ethtool -i * +Cmnd_Alias DISK = /sbin/lsof, /sbin/fdisk -l *, /sbin/sfdisk -d * Cmnd_Alias DATE = /bin/date, /usr/sbin/ntpdate Cmnd_Alias PPPOE_CMDS = /sbin/pppd, /sbin/poff, /usr/sbin/pppstats Cmnd_Alias PCAPTURE = /usr/bin/tshark, /usr/bin/tcpdump %operator ALL=NOPASSWD: DATE, IPTABLES, ETHTOOL, IPFLUSH, \ PPPOE_CMDS, PCAPTURE, /usr/sbin/wanpipemon, \ - /usr/bin/lsof, /usr/sbin/conntrack, IP6TABLES + DISK, CONNTRACK, IP6TABLES EOF cat <>/etc/sudoers %users ALL=NOPASSWD: ${bindir}/sudo-users/ -- cgit v1.2.3