红帽全球峰会4.4. Managing sudo rules with IdM API commands
The examples below show common scenarios of how you can manage sudo rules with the IdM API commands.
- Creating a sudo rule
In this example, you create a sudo rule that holds time change commands.
api.Command.sudorule_add("timechange")- Creating a sudo command
In this example, you create the
datesudo command.api.Command.sudocmd_add("/usr/bin/date")- Attaching a sudo command to a sudo rule
In this example, you attach the
datesudo command to thetimechangesudo rule.api.Command.sudorule_add_allow_command("timechange", sudocmd="/usr/bin/date")- Creating and attaching groups of sudo commands
In this example, you create multiple sudo commands, add them to a newly created
timecmdssudo command group, and attach the group to thetimechangesudo rule.api.Command.sudocmd_add("/usr/bin/date") api.Command.sudocmd_add("/usr/bin/timedatectl") api.Command.sudocmd_add("/usr/sbin/hwclock") api.Command.sudocmdgroup_add("timecmds") api.Command.sudocmdgroup_add_member("timecmds", sudocmd="/usr/bin/date") api.Command.sudocmdgroup_add_member("timecmds", sudocmd="/usr/bin/timedatectl") api.Command.sudocmdgroup_add_member("timecmds", sudocmd="/usr/sbin/hwclock") api.Command.sudorule_add_allow_command("timechange", sudocmdgroup="timecmds")- Denying sudo commands
In this example, you deny the
rmcommand to be run as sudo.api.Command.sudocmd_add("/usr/bin/rm") api.Command.sudorule_add_deny_command("timechange", sudocmd="/usr/bin/rm")- Adding a user to a sudo rule
In this example, you add the user
bobto thetimechangesudo rule.api.Command.sudorule_add_user("timechange", user="bob")- Making a sudo rule available only for a specified host
In this example, you restrict the
timechangerule to be available only for theclient.ipa.testhost.api.Command.sudorule_add_host("timechange", host="client.ipa.test")- Setting sudo rules to be run as a different user
By default, sudo rules are run as
root. In this example, you set thetimechangesudo rule to be run as thealiceuser instead.api.Command.sudorule_add_runasuser("timechange", user="alice")- Setting sudo rules to be run as a group
In this example, you set the
timechangesudo rule to be run as thesysadminsgroup.api.Command.sudorule_add_runasgroup("timechange", group="sysadmins")- Setting a sudo option for a sudo rule
In this example, you set a sudo option for the
timechangesudo rule.api.Command.sudorule_add_option("timechange", ipasudoopt="logfile='/var/log/timechange_log'")- Enabling a sudo rule
In this example, you enable the
timechangesudo rule.api.Command.sudorule_enable("timechange")- Disabling a sudo rule
In this example, you disable the
timechangesudo rule.api.Command.sudorule_disable("timechange")
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}