blob: 13246be9528933e451f2c2933e8e11feeaddf829 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
|
# Some tests to ensure sudo is working properly.
let
password = "helloworld";
in
{ lib, pkgs, ... }:
{
name = "sudo";
meta.maintainers = pkgs.sudo.meta.maintainers;
nodes.machine =
{ lib, ... }:
{
users.groups = {
foobar = { };
barfoo = { };
baz = {
gid = 1337;
};
};
users.users = {
test0 = {
isNormalUser = true;
extraGroups = [ "wheel" ];
};
test1 = {
isNormalUser = true;
password = password;
};
test2 = {
isNormalUser = true;
extraGroups = [ "foobar" ];
password = password;
};
test3 = {
isNormalUser = true;
extraGroups = [ "barfoo" ];
};
test4 = {
isNormalUser = true;
extraGroups = [ "baz" ];
};
test5 = {
isNormalUser = true;
};
};
security.sudo = {
# Explicitly _not_ defining 'enable = true;' here, to check that sudo is enabled by default
wheelNeedsPassword = false;
extraConfig = ''
Defaults lecture="never"
'';
extraRules = [
# SUDOERS SYNTAX CHECK (Test whether the module produces a valid output;
# errors being detected by the visudo checks.
# These should not create any entries
{
users = [ "notest1" ];
commands = [ ];
}
{
commands = [
{
command = "ALL";
options = [ ];
}
];
}
# Test defining commands with the options syntax, though not setting any options
{
users = [ "notest2" ];
commands = [
{
command = "ALL";
options = [ ];
}
];
}
# CONFIGURATION FOR TEST CASES
{
users = [ "test1" ];
groups = [ "foobar" ];
commands = [ "ALL" ];
}
{
groups = [
"barfoo"
1337
];
commands = [
{
command = "ALL";
options = [
"NOPASSWD"
"NOSETENV"
];
}
];
}
{
users = [ "test5" ];
commands = [
{
command = "ALL";
options = [
"NOPASSWD"
"SETENV"
];
}
];
runAs = "test1:barfoo";
}
];
};
};
nodes.strict =
{ ... }:
{
users.users = {
admin = {
isNormalUser = true;
extraGroups = [ "wheel" ];
};
noadmin = {
isNormalUser = true;
};
};
security.sudo = {
enable = true;
wheelNeedsPassword = false;
execWheelOnly = true;
};
};
testScript = ''
with subtest("users in wheel group should have passwordless sudo"):
machine.succeed('su - test0 -c "sudo -u root true"')
with subtest("test1 user should have sudo with password"):
machine.succeed('su - test1 -c "echo ${password} | sudo -S -u root true"')
with subtest("test1 user should not be able to use sudo without password"):
machine.fail('su - test1 -c "sudo -n -u root true"')
with subtest("users in group 'foobar' should be able to use sudo with password"):
machine.succeed('su - test2 -c "echo ${password} | sudo -S -u root true"')
with subtest("users in group 'barfoo' should be able to use sudo without password"):
machine.succeed("sudo -u test3 sudo -n -u root true")
with subtest("users in group 'baz' (GID 1337)"):
machine.succeed("sudo -u test4 sudo -n -u root echo true")
with subtest("test5 user should be able to run commands under test1"):
machine.succeed("sudo -u test5 sudo -n -u test1 true")
with subtest("test5 user should not be able to run commands under root"):
machine.fail("sudo -u test5 sudo -n -u root true")
with subtest("test5 user should be able to keep their environment"):
machine.succeed("sudo -u test5 sudo -n -E -u test1 true")
with subtest("users in group 'barfoo' should not be able to keep their environment"):
machine.fail("sudo -u test3 sudo -n -E -u root true")
with subtest("users in wheel should be able to run sudo despite execWheelOnly"):
strict.succeed('su - admin -c "sudo -u root true"')
with subtest("non-wheel users should be unable to run sudo thanks to execWheelOnly"):
strict.fail('su - noadmin -c "sudo --help"')
'';
}
|
