Using sudo to Delegate Privileges

By default, Cumulus Linux has two user accounts: root and cumulus. The cumulus account is a normal user and is in the group sudo.

You can add more user accounts as needed. Like the cumulus account, these accounts must use sudo to execute privileged commands.

sudo Basics

sudo allows you to execute a command as superuser or another user as specified by the security policy. See man sudo(8) for details.

The default security policy is sudoers, which is configured using /etc/sudoers. Use /etc/sudoers.d/ to add to the default sudoers policy. See man sudoers(5) for details.

By default, users in the sudo group can use sudo to execute privileged commands. To add users to the sudo group, use the useradd(8) or usermod(8) command. To see which users belong to the sudo group, see /etc/group (man group(5)).

Any command can be run as sudo, including su. A password is required.

The example below shows how to use sudo as a non-privileged user cumulus to bring up an interface:

cumulus@switch:~$ ip link show dev swp1
3: swp1: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast master br0 state DOWN mode DEFAULT qlen 500
link/ether 44:38:39:00:27:9f brd ff:ff:ff:ff:ff:ff
 
cumulus@switch:~$ ip link set dev swp1 up
RTNETLINK answers: Operation not permitted
 
cumulus@switch:~$ sudo ip link set dev swp1 up
Password:
 
cumulus@switch:~$ ip link show dev swp1
3: swp1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP mode DEFAULT qlen 500
link/ether 44:38:39:00:27:9f brd ff:ff:ff:ff:ff:ff

sudoers Examples

The following examples show how you grant as few privileges as necessary to a user or group of users to allow them to perform the required task. For each example, the system group noc is used; groups are prefixed with an %.

When executed by an unprivileged user, the example commands below must be prefixed with sudo.

ethtool -m swp1

%noc ALL=(ALL) NOPASSWD:/sbin/ethtool

cl-support

%noc ALL=(ALL) NOPASSWD:/usr/cumulus/bin/cl-support

cl-resource-query

%noc ALL=(ALL) NOPASSWD:/usr/cumulus/bin/cl-resource-query

onie-select http://lab/install.bin

%noc ALL=(ALL) NOPASSWD:/usr/cumulus/bin/onie-select

apt-get update or apt-get install

%noc ALL=(ALL) NOPASSWD:/usr/bin/apt-get

apt-get update

%noc ALL=(ALL) NOPASSWD:/usr/bin/apt-get update

apt-get install vim

%noc ALL=(ALL) NOPASSWD:/usr/bin/apt-get install * 

apt-get upgrade

%noc ALL=(ALL) NOPASSWD:/usr/bin/apt-get upgrade

cl-acltool -i

%noc ALL=(ALL) NOPASSWD:/usr/cumulus/bin/cl-acltool

iptables -L

%noc ALL=(ALL) NOPASSWD:/sbin/iptables

lldpcli show neighbors / configure

%noc ALL=(ALL) NOPASSWD:/usr/sbin/lldpcli

lldpcli show neighbors

%noc ALL=(ALL) NOPASSWD:/usr/sbin/lldpcli show neighbors*

ip link set dev swp1 {up|down}

%noc ALL=(ALL) NOPASSWD:/sbin/ip link set * 

ifup swp1

%noc ALL=(ALL) NOPASSWD:/sbin/ifup

ifdown swp1

%noc ALL=(ALL) NOPASSWD:/sbin/ifdown

ifup swp2 / ifdown swp2

%noc ALL=(ALL) NOPASSWD:/sbin/ifup swp2,/sbin/ifdown swp2

ip addr {add|del} 192.0.2.1/30 dev swp1

%noc ALL=(ALL) NOPASSWD:/sbin/ip addr * 

ip addr add 192.0.2.1/30 dev swp1

%noc ALL=(ALL) NOPASSWD:/sbin/ip addr add * 

brctl addbr br0 / brctl delif br0 swp1

%noc ALL=(ALL) NOPASSWD:/sbin/brctl

brctl addbr br0 / brctl addif br0 swp1

%noc ALL=(ALL) NOPASSWD:/sbin/brctl addbr \*,/sbin/brctl addif * 

mstpctl setmaxage br2 20

%noc ALL=(ALL) NOPASSWD:/sbin/mstpctl

systemctl restart switchd.service

%noc ALL=(ALL) NOPASSWD:/usr/sbin/service switchd * 

systemctl cron switchd.service

%noc ALL=(ALL) NOPASSWD:/usr/sbin/service

tcpdump

%noc ALL=(ALL) NOPASSWD:/usr/sbin/tcpdump

ip route add 10.2.0.0/16 via 10.0.0.1

%noc ALL=(ALL) NOPASSWD:/bin/ip route add * 

ip route del 10.2.0.0/16 via 10.0.0.1

%noc ALL=(ALL) NOPASSWD:/bin/ip route del * 

ip route * 

%noc ALL=(ALL) NOPASSWD:/bin/ip route * 

ip * 

%noc ALL=(ALL) NOPASSWD:/bin/ip

cl-ospf area 0.0.0.1 range 10.0.0.0/24

%noc ALL=(ALL) NOPASSWD:/usr/bin/cl-ospf

Related Information