mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-09-02 07:15:27 +00:00
Code Issues Releases Wiki Activity

Clarify ordering of entries and attributes.

Browse Source
This commit is contained in:
Todd C. Miller
2010-11-30 15:05:44 -05:00
parent 23df0b6fa9
commit 3f605ebfaa
1 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
doc/sudoers.ldap.pod
View File

@@ -153,11 +153,13 @@ If multiple B<sudoNotAfter> entries are present, the last one is used.
=item B<sudoOrder> =item B<sudoOrder>
The sudoRole entries retrieved from the LDAP directory have no The sudoRole entries retrieved from the LDAP directory have no
inherent order. The B<sudoOrder> attribute is an integer that will inherent order. The B<sudoOrder> attribute is an integer (or
be used to sort the matching entries. This allows to more closely floating point value for LDAP servers that support it) that is used
mimic the behaviour of the sudoers file, where the of the entries to sort the matching entries. This allows LDAP-based sudoers entries
does have an influence on the result. If the B<sudoOrder> attribute to more closely mimic the behaviour of the sudoers file, where the
is not present, a value of 0 is assumed. of the entries influences the result. If multiple entries match,
the entry with the lowest B<sudoOrder> attribute is chosen. If the
B<sudoOrder> attribute is not present, a value of 0 is assumed.
=back =back
@@ -195,8 +197,12 @@ to entries that satisfy the time constraints, if any are present.
There are some subtle differences in the way sudoers is handled There are some subtle differences in the way sudoers is handled
once in LDAP. Probably the biggest is that according to the RFC, once in LDAP. Probably the biggest is that according to the RFC,
LDAP ordering is arbitrary and you cannot expect that Attributes LDAP ordering is arbitrary and you cannot expect that Attributes
and Entries are returned in any specific order. If there are and Entries are returned in any specific order.
conflicting command rules on an entry, the negative takes precedence.
The order in which different entries are applied can be controlled
using the B<sudoOrder> attribute, but there is no way to guarantee
the order of attributes within a specific entry. If there are
conflicting command rules in an entry, the negative takes precedence.
This is called paranoid behavior (not necessarily the most specific This is called paranoid behavior (not necessarily the most specific
match). match).