0001674: debian postinst should install sudo commands to /etc/sudoers.d/packetfence, not /etc/sudoers - PacketFence

Bug Tracking System

View Issue Details [ Jump to Notes ]

[ Issue History ] [ Print ]

Project

Tags

No tags attached.

fixed in git revision

fixed in mtn revision

Attached Files

packetfence_sudo.patch [^] (2,055 bytes) 2013-07-29 15:52 [Show Content] [Hide Content]

diff -rupN a/packetfence.postinst b/packetfence.postinst
--- a/packetfence.postinst	2013-07-29 14:35:55.493364228 -0500
+++ b/packetfence.postinst	2013-07-29 14:48:06.181467014 -0500
@@ -94,11 +94,16 @@ case "$1" in
             # Comment out entry from a previous version of PF (< 4.0)
             sed -i 's/^\(pf ALL=NOPASSWD:.*\/sbin\/iptables.*\/usr\/sbin\/ipset\)/#\1/g' /etc/sudoers
         fi
-        if ! (grep "^pf ALL=NOPASSWD:.*/sbin/iptables.*/usr/sbin/ipset.*/sbin/ip.*/sbin/vconfig.*/sbin/route.*/usr/bin/service.*/usr/bin/tee.*/usr/local/pf/sbin/pfdhcplistener.*/bin/kill.*/usr/sbin/dhcpd.*/usr/sbin/freeradius.*/usr/sbin/snort.*/usr/bin/suricata" /etc/sudoers > /dev/null  ) ; then
-            echo "pf ALL=NOPASSWD: /sbin/iptables, /usr/sbin/ipset, /sbin/ip, /sbin/vconfig, /sbin/route, /usr/sbin/service, /usr/bin/tee, /usr/local/pf/sbin/pfdhcplistener, /bin/kill, /usr/sbin/dhcpd, /usr/sbin/freeradius, /usr/sbin/snort, /usr/bin/suricata" >> /etc/sudoers
+        SUDO_FILE=/etc/sudoers.d/packetfence
+        if [ ! -f $SUDO_FILE ]; then
+            touch $SUDO_FILE
+            chmod 0440 $SUDO_FILE
         fi
-        if ! ( grep '^Defaults:pf.*!requiretty' /etc/sudoers > /dev/null ) ; then
-            echo 'Defaults:pf !requiretty' >> /etc/sudoers
+        if ! (grep -q "^pf ALL=NOPASSWD:.*/sbin/iptables.*/usr/sbin/ipset.*/sbin/ip.*/sbin/vconfig.*/sbin/route.*/usr/bin/service.*/usr/bin/tee.*/usr/local/pf/sbin/pfdhcplistener.*/bin/kill.*/usr/sbin/dhcpd.*/usr/sbin/freeradius.*/usr/sbin/snort.*/usr/bin/suricata" $SUDO_FILE ) ; then
+            echo "pf ALL=NOPASSWD: /sbin/iptables, /usr/sbin/ipset, /sbin/ip, /sbin/vconfig, /sbin/route, /usr/sbin/service, /usr/bin/tee, /usr/local/pf/sbin/pfdhcplistener, /bin/kill, /usr/sbin/dhcpd, /usr/sbin/freeradius, /usr/sbin/snort, /usr/bin/suricata" >> $SUDO_FILE
+        fi
+        if ! ( grep -q '^Defaults:pf.*!requiretty' $SUDO_FILE ) ; then
+            echo 'Defaults:pf !requiretty' >> $SUDO_FILE
         fi
 
         update-rc.d packetfence defaults 60 || exit 0

Relationships

Notes
(0003353) fdurand (administrator) 2013-07-31 19:32	Hello, it was there because on squeeze /etc/sudoers does not include /etc/sudoers.d. So now we can place the sudo file inside this directory but i think we can do it by another way. Like in rules file: mkdir -p debian/packetfence/etc/sudoers.d install -m 440 -o root -g root debian/packetfence.sudoers debian/packetfence/etc/sudoers.d/packetfence Where packetfence.sudoers contain all the stuff for sudo and when you remove packetfence then this file will be remove too. Regards Fabrice

(0003957) lmunro (administrator) 2015-02-18 11:20	Moving to github issues. Will be scheduled for inclusion in 5.0

Issue History
Date Modified	Username	Field	Change
2013-07-29 15:52	mzagrabe	New Issue
2013-07-29 15:52	mzagrabe	File Added: packetfence_sudo.patch
2013-07-31 19:32	fdurand	Note Added: 0003353
2015-02-18 11:20	lmunro	Note Added: 0003957
2015-02-18 11:20	lmunro	Status	new => closed
2015-02-18 11:20	lmunro	Assigned To	=> lmunro
2015-02-18 11:20	lmunro	Resolution	open => won't fix