mirror of
https://github.com/openwrt/packages.git
synced 2026-10-12 05:57:04 +04:00
sudo: create sudo group
Add a 'sudo' system group at package-install time using the USERID
mechanism.
Rationale: sudoers configurations that grant privileges to the 'sudo'
group -- the near-universal Debian/Ubuntu idiom, e.g.
%sudo ALL=(ALL:ALL) NOPASSWD: ALL
-- fail silently on OpenWrt today because no 'sudo' group exists in
/etc/group. sudo(8) logs 'unknown group: sudo' and the rule is skipped.
Users also cannot 'usermod -aG sudo <user>' without the group present,
so there is no straightforward way to delegate root without hand-editing
/etc/group or writing per-user sudoers snippets.
Seeding the group here matches how OpenWrt already handles other
service accounts (chrony, dbus, ntpd, ...): the USERID mechanism
creates them lazily via add_group_and_user in the postinst script.
No privileges are granted by default -- an administrator still has to
add users to the group and ship a sudoers rule that references it.
No numeric GID is pinned. The group name is what sudoers, addgroup(1),
and getgrnam() operate on; the numeric GID is invisible to sudo's
authorisation path and matters only for on-disk group ownership
metadata (e.g. 'chgrp sudo' persisted to shared storage) -- something
this package does not do. Letting add_group_and_user pick a dynamic
GID in the 32768+ range keeps sudo out of base-files' reserved
low-range group space and avoids any name-vs-number collision debate.
Bump PKG_RELEASE.
Signed-off-by: Michael Pfeifroth <micpf@westermo.com>
This commit is contained in:
1 parent
ca04783f33
commit
6b5954ef81
1 file changed
+2
-1
+2
-1
@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
|
||||
PKG_NAME:=sudo
|
||||
PKG_REALVERSION:=1.9.17p2
|
||||
PKG_VERSION:=$(subst p,_p,$(PKG_REALVERSION))
|
||||
PKG_RELEASE:=1
|
||||
PKG_RELEASE:=2
|
||||
|
||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_REALVERSION).tar.gz
|
||||
PKG_SOURCE_URL:=https://www.sudo.ws/dist
|
||||
@@ -34,6 +34,7 @@ define Package/sudo
|
||||
CATEGORY:=Administration
|
||||
TITLE:=Delegate authority to run commands
|
||||
URL:=https://www.sudo.ws/
|
||||
USERID:=:sudo
|
||||
DEPENDS:= +USE_GLIBC:libcrypt-compat
|
||||
endef
|
||||
|
||||
|
||||
Reference in new issue
Block a user