Merging multiple files

When multiple input files are specified, cvtsudoers will attempt to merge them into a single policy file. It is assumed that user and group names are consistent among the policy files to be merged. For example, user “bob” on one host is the same as user “bob” on another host.

When merging policy files, it is possible to prefix the input file name with a host name, separated by a colon (‘:’). When the files are merged, the host name will be used to restrict the policy rules to that specific host where possible.

The merging process is performed as follows:

• Each input file is parsed into internal sudoers data structures.
• Aliases are merged and renamed as necessary to avoid conflicts. In the event of a conflict, the first alias found is left as-is and subsequent aliases of the same name are renamed with a numeric suffix separated with a underscore (‘_’). For example, if there are two different aliases named SERVERS, the first will be left as-is and the second will be renamed SERVERS_1. References to the renamed alias are also updated in the policy file. Duplicate aliases (those with identical contents) are pruned.
• Defaults settings are merged and duplicates are removed. If there are conflicts in the Defaults settings, a warning is emitted for each conflict. If a host name is specified with the input file, cvtsudoers will change the global Defaults settings in that file to be host-specific. A warning is emitted for command, user, or runas-specific Defaults settings which cannot be made host-specific.
• Per-user rules are merged and duplicates are removed. If a host name is specified with the input file, cvtsudoers will change rules that specify a host name of ALL to the host name associated with the policy file being merged. The merging of rules is currently fairly simplistic but will be improved in a later release.

It is possible to merge policy files with differing formats.

The cvtsudoers.conf file

Options in the form “keyword = value” may also be specified in a configuration file, /usr/local/etc/cvtsudoers.conf by default. The following keywords are recognized:

defaults = deftypes

See the description of the -d command line option.

expand_aliases = yes | no

See the description of the -e command line option.

group_file = file

See the description of the --group-file command line option.

input_format = ldif | sudoers

See the description of the -i command line option.

match = filter

See the description of the -m command line option.

match_local = yes | no

See the description of the -M command line option.

order_increment = increment

See the description of the -I command line option.

order_start = start_point

See the description of the -O command line option.

output_format = csv | json | ldif | sudoers

See the description of the -f command line option.

padding = padding

See the description of the -P command line option.

passwd_file = file

See the description of the --passwd-file command line option.

prune_matches = yes | no

See the description of the -p command line option.

sudoers_base = dn

See the description of the -b command line option.

suppress = sections

See the description of the -s command line option.

Options on the command line will override values from the configuration file.

JSON output format

The sudoers JSON format may contain any of the following top-level objects:

Defaults

An array of objects, each containing an Options array and an optional Binding array.

The Options array consists of one or more objects, each containing a “name:value” pair that corresponds to a sudoers Defaults setting. Options that operate on a list will also include an operation entry in the object, with a value of “list_assign” for ‘=’, “list_add” for ‘+=’, or “list_remove” for ‘-=’.

The optional Binding array consists of one or more objects, each containing a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. If a Binding is present, the setting will only take effect if one of the specified command, hostname, netgroup, networkaddr, nonunixgid, nonunixgroup, usergid, usergroup, userid, username, or alias entries match.

For example, the following sudoers entry:

Defaults@somehost set_home, env_keep += DISPLAY

converts to:

"Defaults": [
    {
        "Binding": [
            { "hostname": "somehost" }
        ],
        "Options": [
            { "set_home": true },
            {
                "operation": "list_add",
                "env_keep": [
                    "DISPLAY"
                ]
            }
        ]
    }
]

User_Aliases

A JSON object containing one or more sudoers User_Alias entries where each named alias has as its value an array containing one or more objects. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of netgroup, nonunixgid, nonunixgroup, useralias, usergid, usergroup, userid, or username.

For example, the following sudoers entry:

User_Alias SYSADMIN = will, %wheel, +admin

converts to:

"User_Aliases": {
    "SYSADMIN": [
        { "username": "will" },
        { "usergroup": "wheel" },
        { "netgroup": "admin" }
    ]
}

Runas_Aliases

A JSON object containing one or more sudoers Runas_Alias entries, where each named alias has as its value an array containing one or more objects. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of netgroup, nonunixgid, nonunixgroup, runasalias, usergid, usergroup, userid, or username.

For example, the following sudoers entry:

Runas_Alias DB = oracle, sybase : OP = root, operator

converts to:

"Runas_Aliases": {
    "DB": [
        { "username": "oracle" },
        { "username": "sybase" }
    ],
    "OP": [
        { "username": "root" },
        { "username": "operator" }
    ]
}

Host_Aliases

A JSON object containing one or more sudoers Host_Alias entries where each named alias has as its value an array containing one or more objects. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of hostalias, hostname, netgroup, or networkaddr.

For example, the following sudoers entries:

Host_Alias DORMNET = 128.138.243.0, 128.138.204.0/24
Host_Alias SERVERS = boulder, refuge

convert to:

"Host_Aliases": {
    "DORMNET": [
        { "networkaddr": "128.138.243.0" },
        { "networkaddr": "128.138.204.0/24" }
    ],
    "SERVERS": [
        { "hostname": "boulder" },
        { "hostname": "refuge" }
    ]
}

Cmnd_Aliases

A JSON object containing one or more sudoers Cmnd_Alias entries where each named alias has as its value an array containing one or more objects. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be either another cmndalias or a command. For example, the following sudoers entries:

Cmnd_Alias SHELLS = /bin/bash, /bin/csh, /bin/sh, /bin/zsh
Cmnd_Alias VIPW = /usr/bin/chpass, /usr/bin/chfn, /usr/bin/chsh, \
                  /usr/bin/passwd, /usr/sbin/vigr, /usr/sbin/vipw

convert to:

"Cmnd_Aliases": {
    "SHELLS": [
        { "command": "/bin/bash" },
        { "command": "/bin/csh" },
        { "command": "/bin/sh" },
        { "command": "/bin/zsh" }
    ],
    "VIPW": [
        { "command": "/usr/bin/chpass" },
        { "command": "/usr/bin/chfn" },
        { "command": "/usr/bin/chsh" },
        { "command": "/usr/bin/passwd" },
        { "command": "/usr/sbin/vigr" },
        { "command": "/usr/sbin/vipw" }
    ]
}

User_Specs

A JSON array containing one or more objects, each representing a sudoers User_Spec. Each object in the User_Specs array should contain a User_List array, a Host_List array and a Cmnd_Specs array.

A User_List consists of one or more objects. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of netgroup, nonunixgid, nonunixgroup, useralias, usergid, usergroup, userid, or username. If username is set to the special value ALL, it will match any user.

A Host_List consists of one or more objects. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of hostalias, hostname, netgroup, or networkaddr. If hostname is set to the special value ALL, it will match any host.

The Cmnd_Specs array consists of one or more JSON objects describing a command that may be run. Each Cmnd_Specs is made up of a Commands array, an optional runasusers array, an optional runasgroups array, and an optional Options array.

The Commands array consists of one or more objects containing “name:value” pair elements. The following names and values are supported:

command

A string containing the command to run. The special value ALL it will match any command.

negated

A boolean value that, if true, will negate any comparison performed with the object.

sha224

One or more SHA224 digests for the command in string form. Multiple digests of the same type are stored as an array.

sha256

One or more SHA256 digests for the command in string form. Multiple digests of the same type are stored as an array.

sha384

One or more SHA384 digests for the command in string form. Multiple digests of the same type are stored as an array.

sha512

One or more SHA512 digests for the command in string form. Multiple digests of the same type are stored as an array.

The runasusers array consists of objects describing users the command may be run as. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of netgroup, nonunixgid, nonunixgroup, runasalias, usergid, usergroup, userid, or username. If username is set to the special value ALL, it will match any user. If username is set to the empty string “”, it will match the invoking user.

The runasgroups array consists of objects describing groups the command may be run as. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of runasalias, usergid, or usergroup. If usergroup is set to the special value ALL, it will match any group.

The Options array is of the same format as the one in the Defaults object. Any Tag_Spec entries in sudoers are converted to Options. A user with “sudo ALL” privileges will automatically have the setenv option enabled to match the implicit behavior provided by sudoers.

For example, the following sudoers entry:

millert ALL = (ALL : ALL) NOPASSWD: ALL, !/usr/bin/id

converts to:

"User_Specs": [
    {
        "User_List": [
            { "username": "millert" }
        ],
        "Host_List": [
            { "hostname": "ALL" }
        ],
        "Cmnd_Specs": [
            {
                "runasusers": [
                    { "username": "ALL" }
                ],
                "runasgroups": [
                    { "usergroup": "ALL" }
                ],
                "Options": [
                    { "authenticate": false },
                    { "setenv": true }
                ],
                "Commands": [
                    { "command": "ALL" },
                    {
                        "command": "/usr/bin/id",
                        "negated": true
                    }
                ]
            }
        ]
    }
]

CSV output format

CSV (comma-separated value) files are often used by spreadsheets and report generators. For CSV output, cvtsudoers double quotes strings that contain commas. For each literal double quote character present inside the string, two double quotes are output. This method of quoting commas is compatible with most spreadsheet programs.

There are three possible sections in cvtsudoers's CSV output, each separated by a blank line:

defaults

This section includes any Defaults settings in sudoers. The defaults section begins with the following heading:

defaults_type,binding,name,operator,value

The fields are as follows:

defaults_type

The type of Defaults setting; one of defaults, defaults_command, defaults_host, defaults_runas, or defaults_user.

binding

For defaults_command, defaults_host, defaults_runas, and defaults_user this is the value that must match for the setting to be applied.

name

The name of the Defaults setting.

operator

The operator determines how the value is applied to the setting. It may be either ‘=’ (assignment), ‘+=’ (append), or ‘-=’ (remove).

value

The setting's value, usually a string or, for settings used in a boolean context, true or false.

aliases

This section includes any Cmnd_Alias Host_Alias, Runas_Alias, or User_Alias, entries from sudoers. The aliases section begins with the following heading:

alias_type,alias_name,members

The fields are as follows:

alias_type

The type of alias; one of Cmnd_Alias, Host_Alias, Runas_Alias, or User_Alias.

alias_name

The name of the alias; a string starting with an upper-case letter that consists of upper-case letters, digits, or underscores.

members

A comma-separated list of members belonging to the alias. Due to the use of commas, members is surrounded by double quotes if it contains more than one member.

rules

This section includes the sudoers rules that grant privileges. The rules section begins with the following heading:

rule,user,host,runusers,rungroups,options,command

The fields are as follows:

rule

This field indicates a sudoers rule entry.

user

The user the rule applies to. This may also be a Unix group (preceded by a ‘%’ character), a non-Unix group (preceded by ‘%:’) or a netgroup (preceded by a ‘+’ character) or a User_Alias. If set to the special value ALL, it will match any user.

host

The host the rule applies to. This may also be a netgroup (preceded by a ‘+’ character) or a Host_Alias. If set to the special value ALL, it will match any host.

runusers

An optional comma-separated list of users (or Runas_Aliases) the command may be run as. If it contains more than one member, the value is surrounded by double quotes. If set to the special value ALL, it will match any user. If empty, the root user is assumed.

rungroups

An optional comma-separated list of groups (or Runas_Aliases) the command may be run as. If it contains more than one member, the value is surrounded by double quotes. If set to the special value ALL, it will match any group. If empty, the runuser's group is used.

options

An optional list of Defaults settings to apply to the command. Any Tag_Spec entries in sudoers are converted to options.

commands

A list of commands, with optional arguments, that the user is allowed to run. If set to the special value ALL, it will match any command.

For example, the following sudoers entry:

millert ALL = (ALL : ALL) NOPASSWD: ALL, !/usr/bin/id

converts to:

rule,millert,ALL,ALL,ALL,"!authenticate","ALL,!/usr/bin/id"