[spin-kickstarts] #59: edora-cloud-base-vagrant image has incorrect sudo privs

[fedora-badges]

#59: edora-cloud-base-vagrant image has incorrect sudo privs
-----------------------------+---------------------
  Reporter:  semyers         |      Owner:  kanarip
      Type:  defect          |     Status:  new
  Priority:  major           |  Milestone:
 Component:  kickstart pool  |   Keywords:  vagrant
Blocked By:                  |   Blocking:
-----------------------------+---------------------
 = bug description =
 The fedora-cloud-base-vagrant image does not have the vagrant-recommended
 sudo privileges.

 The vagrant user is granted "ALL=NOPASSWD: ALL", but should be granted
 "vagrant ALL=(ALL) NOPASSWD: ALL"

 = bug analysis =

 In [https://git.fedorahosted.org/cgit/spin-kickstarts.git/tree/fedora-
 cloud-base-vagrant.ks?id=6b42371f723437214404c37366e7784004e12dc3#n45 the
 current state], the vagrant user cannot act as other users with sudo.
 Given passwordless sudo, the vagrant user easily has the ability to gain
 this functionality (this is my current workaround), so it should probably
 be the default anyway.

 Without the "(ALL)" in the sudoers line:

 {{{
 [vagrant@dev ~]$ sudo -u nobody ls /
 [sudo] password for vagrant:
 Sorry, user vagrant is not allowed to execute '/bin/ls /' as nobody on
 dev.
 }}}


 With the "(ALL)" in the sudoers line:

 {{{
 [vagrant@dev ~]$ sudo -u nobody ls /
 bin  boot  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc
 root  run  sbin  srv  sys  tmp  usr  vagrant  var
 }}}



 = fix recommendation =

 In the fedora-cloud-base-vagrant kickstart, replace

 {{{
 echo 'vagrant ALL=NOPASSWD: ALL' > /etc/sudoers.d/vagrant-nopasswd
 }}}

 with

 {{{
 echo 'vagrant ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/vagrant-nopasswd
 }}}

 As described in the vagrant docs, under "Password-less sudo":
 https://docs.vagrantup.com/v2/boxes/base.html

-- 
Ticket URL: <https://fedorahosted.org/spin-kickstarts/ticket/59>
spin-kickstarts <https://fedorahosted.org/spin-kickstarts/>
Kickstarts that the Spin SIG reviews, tests, maintains and releases (as a package).

[spin-kickstarts] #59: fedora-cloud-base-vagrant image has incorrect sudo privs (was: edora-cloud-base-vagrant image has incorrect sudo privs)

[fedora-badges]

#59: fedora-cloud-base-vagrant image has incorrect sudo privs
----------------------------+----------------------
 Reporter:  semyers         |       Owner:  kanarip
     Type:  defect          |      Status:  new
 Priority:  major           |   Milestone:
Component:  kickstart pool  |  Resolution:
 Keywords:  vagrant         |  Blocked By:
 Blocking:                  |
----------------------------+----------------------

-- 
Ticket URL: <https://fedorahosted.org/spin-kickstarts/ticket/59#comment:1>
spin-kickstarts <https://fedorahosted.org/spin-kickstarts/>
Kickstarts that the Spin SIG reviews, tests, maintains and releases (as a package).

[spin-kickstarts] #59: fedora-cloud-base-vagrant image has incorrect sudo privs

[fedora-badges]

#59: fedora-cloud-base-vagrant image has incorrect sudo privs
----------------------------+----------------------
 Reporter:  semyers         |       Owner:  kanarip
     Type:  defect          |      Status:  new
 Priority:  major           |   Milestone:
Component:  kickstart pool  |  Resolution:
 Keywords:  vagrant         |  Blocked By:
 Blocking:                  |
----------------------------+----------------------
Changes (by rbarlow):

 * cc: rbarlow@… (added)


-- 
Ticket URL: <https://fedorahosted.org/spin-kickstarts/ticket/59#comment:2>
spin-kickstarts <https://fedorahosted.org/spin-kickstarts/>
Kickstarts that the Spin SIG reviews, tests, maintains and releases (as a package).