Verify validity of sudoers file when reconfiguring system.

Verify validity of sudoers file when reconfiguring system.

[pkill9]

Last time I tested, the sudoers file could be changed to anything in
the guix system configuration, whether it's valid or not. This could
result in someone being locked out of their system when root doesn't
have a password, and they rely on sudo. Ideally, `guix system
reconfigure` would fail if the specified sudoers file is invalid.

I ran `visudo --help` and there are two flags that could be used for
this: --check, which simply parses the sudoers file and checks that
it's valid, and --file, which specifies which file to check.

Re: Verify validity of sudoers file when reconfiguring system.

[Ludovic Courtès]

Hi pkill9,

pkill9 <pkill9@runbox.com> skribis:

> Last time I tested, the sudoers file could be changed to anything in
> the guix system configuration, whether it's valid or not. This could
> result in someone being locked out of their system when root doesn't
> have a password, and they rely on sudo. Ideally, `guix system
> reconfigure` would fail if the specified sudoers file is invalid.
>
> I ran `visudo --help` and there are two flags that could be used for
> this: --check, which simply parses the sudoers file and checks that
> it's valid, and --file, which specifies which file to check.

Thanks a lot for the suggestion!  Commit
384377632c41c5c42e32889f4a239223aaae1ca9 implements exactly that.
Apparently ‘visudo --check’ doesn’t check whether the user/groups
mentioned exist though, so this kind of error could still occur.

The better fix would be to define record types or similar for the
sudoers list so we can better sanitize it.

Ludo’.