diff options
author | ivanbrennan <ivan.brennan@gmail.com> | 2018-07-01 15:26:07 -0400 |
---|---|---|
committer | ivanbrennan <ivan.brennan@gmail.com> | 2018-07-01 15:50:51 -0400 |
commit | d08967a3a84281270180027b96e5d91924f4bec1 (patch) | |
tree | 7066e4c8903653f07830a060962ed46dd5e44224 /nixos | |
parent | bc7c7b2b09ed93910a24645e284250351c9d023d (diff) |
nixos/security.sudo: describe extraRules order
The order of sudoers entries is significant. The man page for sudoers(5) notes: Where there are multiple matches, the last match is used (which is not necessarily the most specific match). This module adds a rule for group "wheel" matching all commands. If you wanted to add a more specific rule allowing members of the "wheel" group to run command `foo` without a password, you'd need to use mkAfter to ensure your rule comes after the more general rule. extraRules = lib.mkAfter [ { groups = [ "wheel" ]; commands = [ { command = "${pkgs.foo}/bin/foo"; options = [ "NOPASSWD" "SETENV" ]; } ] } ]; Otherwise, when configuration options are merged, if the general rule ends up after the specific rule, it will dictate the behavior even when running the `foo` command.
Diffstat (limited to 'nixos')
-rw-r--r-- | nixos/modules/security/sudo.nix | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/nixos/modules/security/sudo.nix b/nixos/modules/security/sudo.nix index 24283e1d6165c..361a7e869602c 100644 --- a/nixos/modules/security/sudo.nix +++ b/nixos/modules/security/sudo.nix @@ -66,6 +66,9 @@ in security.sudo.extraRules = mkOption { description = '' Define specific rules to be in the <filename>sudoers</filename> file. + More specific rules should come after more general ones in order to + yield the expected behavior. You can use mkBefore/mkAfter to ensure + this is the case when configuration options are merged. ''; default = []; example = [ |