[Freeipa-devel] Sudoers schema

[Rob Crittenden]

Dmitri Pal wrote:
> Hello,
>
> It occurred to me that we can have a compromise. We can have two ways
> and let the admins to decide which model to follow.
> So the schema will look like this:
> The sudo rule entry will have a string attribute to put a command
> verbatim as it is designed now and an attribute that contains a DN of a
> group of the commands (or points to commands individually).
>
> It seems though that instead of having separate objects for a command
> with just one attribute (the command itself) and then have an group of
> commands object with pointer to individual commands we can have just a
> command group object with a multi value attribute for commands entered
> verbatim.
> This way we  probably even do not need  to have two attributes as I
> proposed above.

A creative solution but I'd almost rather go with the complex way than 
this. If you wanted to change a command-line you'd have to manually go 
through all the groups and change them one at a time.

I'm not 100% opposed to the command and group-of-commands interface I 
just wonder if in the typical case it isn't overkill. For those with 
thousands of sudo rules it may make a lot of sense. My initial objection 
was it seemed to be over-engineered, a Bentley when a Pinto would do :-)

>
> Sorry for designing on the fly.
> So options are:
> 1) Leave as designed - does not provide a good role management (Nack)
> 2) Revert to original - too complex and limiting (Nack)
> 3) Have a hybrid of 1)&  2) represented by two attributes
> 4) Make the rule reference an object named command group. The command
> group object will have a mv attribute with the commands
>
> IMO the last one is the simple compromise that addresses both concerns.

Let me tell you how this would work on the command line. We'd likely 
have 3 plugins (I'm not married to these names, they are just illustrative):

- sudo_cmds: CRUD for managing the individual commands
- sudo_group: CRUD for grouping sudo_cmds into groups of commands
- sudo_rules: CRUD for managing the rules themselves, the core of which 
assigning sudo_groups and/or sudo_cmds to it.

I gather that a sudo command would use the memberOf plugin to be a 
member of a sudo group, right? Could that be skipped? It does help us 
know what groups use a given command but we can run a query to find that 
if necessary. That might alleviate Simo's concern that memberOf isn't free.

The other problem with multi-value commands is we don't yet have a nice 
way on the command-line to manage them. You'd want to be able to do 
things like "delete the 3rd of these 5" or "modify the 7th one to this", 
etc.

rob