An array of objects, each containing an Options array and an optional Binding array. The Options array consists of one or more objects, each containing a “name:value” pair that corresponds to a sudoers Defaults setting. Options that operate on a list will also include an operation entry in the object, with a value of “list_assign” for ‘=’, “list_add” for ‘+=’, or “list_remove” for ‘-=’.
The optional Binding array consists of one or more objects, each containing a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. If a Binding is present, the setting will only take effect if one of the specified command, hostname, netgroup, networkaddr, nonunixgid, nonunixgroup, usergid, usergroup, userid, username, or alias entries match.
For example, the following sudoers entry:
Defaults@somehost set_home, env_keep += DISPLAY
converts to:
"Defaults": [
{
"Binding": [
{ "hostname": "somehost" }
],
"Options": [
{ "set_home": true },
{
"operation": "list_add",
"env_keep": [
"DISPLAY"
]
}
]
}
] A JSON array containing one or more objects, each representing a sudoers User_Spec. Each object in the User_Specs array should contain a User_List array, a Host_List array and a Cmnd_Specs array. A User_List consists of one or more objects. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of netgroup, nonunixgid, nonunixgroup, useralias, usergid, usergroup, userid, or username. If username is set to the special value ALL, it will match any user.
A Host_List consists of one or more objects. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of hostalias, hostname, netgroup, or networkaddr. If hostname is set to the special value ALL, it will match any host.
The Cmnd_Specs array consists of one or more JSON objects describing a command that may be run. Each Cmnd_Specs is made up of a Commands array, an optional runasusers array, an optional runasgroups array, and an optional Options array.
The Commands array consists of one or more objects containing “name:value” pair elements. The following names and values are supported:
- command
- A string containing the command to run. The special value ALL it will match any command.
- negated
- A boolean value that, if true, will negate any comparison performed with the object.
- sha224
- A string containing the SHA224 digest of the command.
- sha256
- A string containing the SHA256 digest of the command.
- sha384
- A string containing the SHA384 digest of the command.
- sha512
- A string containing the SHA512 digest of the command.
The runasusers array consists of objects describing users the command may be run as. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of netgroup, nonunixgid, nonunixgroup, runasalias, usergid, usergroup, userid, or username. If username is set to the special value ALL, it will match any user. If username is set to the empty string “”, it will match the invoking user.
The runasgroups array consists of objects describing groups the command may be run as. Each object contains a “name:value” pair and an optional negated entry, which will negate any comparison performed with the object. The name may be one of runasalias, usergid, or usergroup. If usergroup is set to the special value ALL, it will match any group.
The Options array is of the same format as the one in the Defaults object. Any Tag_Spec entries in sudoers are converted to Options. A user with “sudo ALL” privileges will automatically have the setenv option enabled to match the implicit behavior provided by sudoers.
For example, the following sudoers entry:
millert ALL = (ALL : ALL) NOPASSWD: ALL, !/usr/bin/id
converts to:
"User_Specs": [
{
"User_List": [
{ "username": "millert" }
],
"Host_List": [
{ "hostname": "ALL" }
],
"Cmnd_Specs": [
{
"runasusers": [
{ "username": "ALL" }
],
"runasgroups": [
{ "usergroup": "ALL" }
],
"Options": [
{ "authenticate": false },
{ "setenv": true }
],
"Commands": [
{ "command": "ALL" },
{
"command": "/usr/bin/id",
"negated": true
}
]
}
]
}
]