* Verify validity of sudoers file when reconfiguring system.
@ 2020-08-02 12:11 pkill9
2020-08-24 21:29 ` Ludovic Courtès
0 siblings, 1 reply; 2+ messages in thread
From: pkill9 @ 2020-08-02 12:11 UTC (permalink / raw)
To: guix-devel@gnu.org
Last time I tested, the sudoers file could be changed to anything in
the guix system configuration, whether it's valid or not. This could
result in someone being locked out of their system when root doesn't
have a password, and they rely on sudo. Ideally, `guix system
reconfigure` would fail if the specified sudoers file is invalid.
I ran `visudo --help` and there are two flags that could be used for
this: --check, which simply parses the sudoers file and checks that
it's valid, and --file, which specifies which file to check.
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Verify validity of sudoers file when reconfiguring system.
2020-08-02 12:11 Verify validity of sudoers file when reconfiguring system pkill9
@ 2020-08-24 21:29 ` Ludovic Courtès
0 siblings, 0 replies; 2+ messages in thread
From: Ludovic Courtès @ 2020-08-24 21:29 UTC (permalink / raw)
To: pkill9; +Cc: guix-devel@gnu.org
Hi pkill9,
pkill9 <pkill9@runbox.com> skribis:
> Last time I tested, the sudoers file could be changed to anything in
> the guix system configuration, whether it's valid or not. This could
> result in someone being locked out of their system when root doesn't
> have a password, and they rely on sudo. Ideally, `guix system
> reconfigure` would fail if the specified sudoers file is invalid.
>
> I ran `visudo --help` and there are two flags that could be used for
> this: --check, which simply parses the sudoers file and checks that
> it's valid, and --file, which specifies which file to check.
Thanks a lot for the suggestion! Commit
384377632c41c5c42e32889f4a239223aaae1ca9 implements exactly that.
Apparently ‘visudo --check’ doesn’t check whether the user/groups
mentioned exist though, so this kind of error could still occur.
The better fix would be to define record types or similar for the
sudoers list so we can better sanitize it.
Ludo’.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-08-24 21:29 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-08-02 12:11 Verify validity of sudoers file when reconfiguring system pkill9
2020-08-24 21:29 ` Ludovic Courtès
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).