Sudoers

let del_negate = del /(!!)*/ ""

Delete an even number of ‘!’ signs

let negate_node = [ del "!" "!" . label "negate" ]

Negation of boolean values for defaults.  Accept one optional ‘!’ and produce a ‘negate’ node if there is one.

let negate_or_value (key:lens) (value:lens) = [ del_negate . (negate_node . key | key . value) ]

A del_negate, followed by either a negated key, or a key/value pair

let comment = let sto_to_eol = store (/([^ \t\n].*[^ \t\n]|[^ \t\n])/ - /include(dir)?.*/) in [ label "#comment" . del /[ \t]*#[ \t]*/ "# " . sto_to_eol . eol ]

Map comments in “#comment” nodes

let comment_eol = Util.comment_generic /[ \t]+#[ \t]*/ " # "

Requires a space before the #

let comment_or_eol = comment_eol | (del /([ \t]+#\n|[ \t]*\n)/ "\n")

A comment_eol or eol

let empty = [ del /[ \t]*#?[ \t]*\n/ "\n" ]

Map empty lines

let includedir = [ key /#include(dir)?/ . Sep.space . store Rx.fspath . eol ]

let alias_field (kw:string) (sto:lens) = [ label kw . sto ]

Generic alias field to gather all Alias definitions

Definition

User_Alias ::= NAME '=' User_List
Runas_Alias ::= NAME '=' Runas_List
Host_Alias ::= NAME '=' Host_List
Cmnd_Alias ::= NAME '=' Cmnd_List

Parameters

let alias_list (kw:string) (sto:lens) = Build.opt_list (alias_field kw sto) sep_com

List of alias_fields, separated by commas

let alias_name = [ label "name" . store /[A-Z][A-Z0-9_]*/ ]

Name of an alias_entry_single

Definition

NAME ::= [A-Z]([A-Z][0-9]_)*

let alias_entry_single (field:string) (sto:lens) = [ label "alias" . alias_name . sep_eq . alias_list field sto ]

Single alias_entry, named using alias_name and listing alias_list

Definition

Alias_Type NAME = item1, item2, ...

Parameters

let alias_entry (kw:string) (field:string) (sto:lens) = [ indent . key kw . sep_cont . alias_entry_single field sto . ( sep_col . alias_entry_single field sto )* . comment_or_eol ]

Alias entry, a list of comma-separated alias_entry_single fields

Definition

Alias_Type NAME = item1, item2, item3 : NAME = item4, item5

Parameters

let user_alias = alias_entry "User_Alias" "user" sto_to_com

User_Alias, see alias_field

let runas_alias = alias_entry "Runas_Alias" "runas_user" sto_to_com

Run_Alias, see alias_field

let host_alias = alias_entry "Host_Alias" "host" sto_to_com

Host_Alias, see alias_field

let cmnd_alias = alias_entry "Cmnd_Alias" "command" sto_to_com_cmnd

Cmnd_Alias, see alias_field

let alias = user_alias | runas_alias | host_alias | cmnd_alias

Every kind of Alias entry, see user_alias, runas_alias, host_alias and cmnd_alias

Definition

Alias ::= 'User_Alias'  User_Alias (':' User_Alias)* |
          'Runas_Alias' Runas_Alias (':' Runas_Alias)* |
          'Host_Alias'  Host_Alias (':' Host_Alias)* |
          'Cmnd_Alias'  Cmnd_Alias (':' Cmnd_Alias)*

let default_type = let value = store /[@:!>][^ \t\n\\]+/ in [ label "type" . value ]

Type definition for defaults

Definition

Default_Type ::= 'Defaults' |
                 'Defaults' '@' Host_List |
                 'Defaults' ':' User_List |
                 'Defaults' '!' Cmnd_List |
                 'Defaults' '>' Runas_List

let parameter_flag_kw = "always_set_home" | "authenticate" | "env_editor" | "env_reset" | "fqdn" | "ignore_dot" | "ignore_local_sudoers" | "insults" | "log_host" | "log_year" | "long_otp_prompt" | "mail_always" | "mail_badpass" | "mail_no_host" | "mail_no_perms" | "mail_no_user" | "noexec" | "path_info" | "passprompt_override" | "preserve_groups" | "requiretty" | "root_sudo" | "rootpw" | "runaspw" | "set_home" | "set_logname" | "setenv" | "shell_noargs" | "stay_setuid" | "targetpw" | "tty_tickets" | "visiblepw" | "closefrom_override" | "closefrom_override" | "compress_io" | "fast_glob" | "log_input" | "log_output" | "pwfeedback" | "umask_override" | "use_pty" | "match_group_by_gid" | "always_query_group_plugin"

A flag parameter for defaults

Flags are implicitly boolean and can be turned off via the ‘!’  operator.  Some integer, string and list parameters may also be used in a boolean context to disable them.

let parameter_integer_nobool_kw = "passwd_tries"

An integer parameter for defaults

let parameter_string_nobool_kw = "badpass_message" | "editor" | "mailsub" | "noexec_file" | "passprompt" | "runas_default" | "syslog_badpri" | "syslog_goodpri" | "timestampdir" | "timestampowner" | "secure_path"

A string parameter for defaults

An odd number of ‘!’ operators negate the value of the item; an even number just cancel each other out.

let parameter_lists_kw = "env_check" | "env_delete" | "env_keep"

A single list parameter for defaults

All lists can be used in a boolean context The argument may be a double-quoted, space-separated list or a single value without double-quotes.  The list can be replaced, added to, deleted from, or disabled by using the =, +=, -=, and ! operators respectively.  An odd number of ‘!’ operators negate the value of the item; an even number just cancel each other out.

let parameter = parameter_flag | parameter_integer | parameter_string | parameter_lists

A single parameter for defaults

Definition

Parameter ::= Parameter '=' Value |
              Parameter '+=' Value |
              Parameter '-=' Value |
              '!'* Parameter

Parameters may be flags, integer values, strings, or lists.

let parameter_list = parameter . ( sep_com . parameter )*

A list of comma-separated parameters for defaults

Definition

Parameter_List ::= Parameter |
                   Parameter ',' Parameter_List

let defaults = [ indent . key "Defaults" . default_type? . sep_cont . parameter_list . comment_or_eol ]

A Defaults entry

Definition

Default_Entry ::= Default_Type Parameter_List

let runas_spec_user = alias_list "runas_user" sto_to_com

A runas specification for spec, using alias_list for listing users and/or groups used to run a command

Definition

Runas_Spec ::= '(' Runas_List ')' |
               '(:' Runas_List ')' |
               '(' Runas_List ':' Runas_List ')'

let tag_spec = [ label "tag" . store /(NO)?(PASSWD|EXEC|SETENV)/ . sep_col ]

Tag specification for spec

Definition

Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
             'SETENV:' | 'NOSETENV:')

let cmnd_spec = [ label "command" . runas_spec? . tag_spec* . sto_to_com_cmnd ]

Command specification for spec, with optional runas_spec and any amount of tag_specs

Definition

Cmnd_Spec ::= Runas_Spec? Tag_Spec* Cmnd

let cmnd_spec_list = Build.opt_list cmnd_spec sep_com

A list of comma-separated cmnd_specs

Definition

Cmnd_Spec_List ::= Cmnd_Spec |
                   Cmnd_Spec ',' Cmnd_Spec_List

let spec_list = [ label "host_group" . alias_list "host" sto_to_com_host . sep_eq . cmnd_spec_list ]

Group of hosts with cmnd_spec_list

let spec = [ label "spec" . indent . alias_list "user" sto_to_com_user . sep_cont . Build.opt_list spec_list sep_col . comment_or_eol ]

A user specification, listing colon-separated spec_lists

Definition

User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \
              (':' Host_List '=' Cmnd_Spec_List)*

let lns = ( empty | comment | includedir | alias | defaults | spec )*

The sudoers lens, any amount of

• empty lines
• comments
• includedirs
• aliases
• defaults
• specs