mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-08-31 06:15:37 +00:00
Code Issues Releases Wiki Activity

Clarify ordering of entries and attributes.

Browse Source
This commit is contained in:
Todd C. Miller
2010-11-30 15:05:44 -05:00
parent 23df0b6fa9
commit 3f605ebfaa
1 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
doc/sudoers.ldap.pod
View File

@@ -153,11 +153,13 @@ If multiple B<sudoNotAfter> entries are present, the last one is used.
=item B<sudoOrder>
The sudoRole entries retrieved from the LDAP directory have no
inherent order. The B<sudoOrder> attribute is an integer that will
be used to sort the matching entries. This allows to more closely
mimic the behaviour of the sudoers file, where the of the entries
does have an influence on the result. If the B<sudoOrder> attribute
is not present, a value of 0 is assumed.
inherent order. The B<sudoOrder> attribute is an integer (or
floating point value for LDAP servers that support it) that is used
to sort the matching entries. This allows LDAP-based sudoers entries
to more closely mimic the behaviour of the sudoers file, where the
of the entries influences the result. If multiple entries match,
the entry with the lowest B<sudoOrder> attribute is chosen. If the
B<sudoOrder> attribute is not present, a value of 0 is assumed.
=back
@@ -195,8 +197,12 @@ to entries that satisfy the time constraints, if any are present.
There are some subtle differences in the way sudoers is handled
once in LDAP. Probably the biggest is that according to the RFC,
LDAP ordering is arbitrary and you cannot expect that Attributes
and Entries are returned in any specific order. If there are
conflicting command rules on an entry, the negative takes precedence.
and Entries are returned in any specific order.
The order in which different entries are applied can be controlled
using the B<sudoOrder> attribute, but there is no way to guarantee
the order of attributes within a specific entry. If there are
conflicting command rules in an entry, the negative takes precedence.
This is called paranoid behavior (not necessarily the most specific
match).