We covered this on a very basic level last week, but today we’re going to focus on the User_Alias policy entries.
A sudo policy begins with a list of users and/or groups. This list can be a raw listing, or it can be a label created by a “User_Alias” entry. Organization of the policy file depends on your needs, but one common way to organize things is to use the aliases to define how pieces of a policy should look, then put all of the policies at the bottom where the alias labels are used to build out those policies. There are other ways to structure this, as well, and we’ll cover several of them later. For now, we’ll assume that we are doing one section of the file to cover all User_Alias entries, another section for all Cmnd_Alias entries, and so on.
A User_Alias entry is simply the key word “User_Alias” followed by the label name you would like to use, and equal sign “=” and the list of users and/or groups, comma separated, that the labeled alias will define.
User_Alias U_WEBADMINS = %webslingers
If you want to allow a group, but restrict one member of the group from having the access to the policy, you can modify it like so:
User_Alias U_WEBADMINS = %webslingers, !venom
Less useful in most situations, but still available as an option, is to use UID and GID numbers to represent the users and groups. If the “webslingers” group has GID 404, and the “venom” user has a UID of 666, the same policy as above could be written this way, instead:
User_Alias U_WEBADMINS = %#404, !666
If you are using yellow pages with net groups, you can also reference a netgroup using a “+” instead of “%” to represent the group.
Finally, non-Unix group names and GIDs are represented with “%:” and “%:#” prefixes, instead of just “%” or “%#” per normal.
This is simple stuff, but I’ve seen poorly constructed “user alias” entries before. This is why we’re taking it slow and hitting each type separately as we go. A lot of this will seem redundant, but hopefully it lays it out in a simple and easily understood manner.
Thanks for reading! Next week will be Host_Alias labels, simply because it is the next piece of the policy entry as read from left to right.