[SSSD] SUDO: provide manual pages

Jakub Hrozek jhrozek at redhat.com
Mon Jan 30 09:57:35 UTC 2012


Unfortunately Pavel did not have enough time to finish all the sudo
related tickets that would change strings and therefore must be done in
time for 1.7.9.

I've been pulling patches from his personal git tree, finishing and
polishing them up as appropriate. Attached are two patches that build
sudo-related manual pages.

https://fedorahosted.org/sssd/ticket/1109

[PATCH 1/2] SUDO Integration - manual page
This is Pavel's original patch. I just removed documentation on one
option that is not yet in master and squashed it into the appropriate
patch that I will send for review later.

[PATCH 2/2] Include sudo manual pages only conditionally
Sudo is still an experimental feature. We don't want to document it for
builds that do not include the sudo feature.

I used the "profiling" feature of DocBook to achieve that:
http://www.sagehill.net/docbookxsl/Profiling.html

Each subsequent experimental feature would then just add a new CONDS+=
to the Makefile and mark the optional section with the standard DocBook
"condition" parameter.

The patch also marks the sections in the man page as experimental.
-------------- next part --------------
From df8e01cf2ad41f17e36fed2231a8d51c4c97825b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina at redhat.com>
Date: Mon, 16 Jan 2012 10:21:54 +0100
Subject: [PATCH 1/2] SUDO Integration - manual page

https://fedorahosted.org/sssd/ticket/1109
---
 src/man/sssd-ldap.5.xml |  188 +++++++++++++++++++++++++++++++++++++++++++++++
 src/man/sssd.conf.5.xml |   25 ++++++-
 2 files changed, 212 insertions(+), 1 deletions(-)

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index fca13f8da723dba8d44e692ed9bd541bf6070222..5afa9ad7942f8b57431965ef0e580a8def0fc0bb 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -1554,6 +1554,175 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
                     </listitem>
                 </varlistentry>
 
+                <varlistentry>
+                    <term>ldap_sudorule_object_class (string)</term>
+                    <listitem>
+                        <para>
+                            The object class of a sudo rule entry in LDAP.
+                        </para>
+                        <para>
+                            Default: sudoRole
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>ldap_sudorule_name (string)</term>
+                    <listitem>
+                        <para>
+                            The LDAP attribute that corresponds to
+                            the sudo rule name.
+                        </para>
+                        <para>
+                            Default: cn
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>ldap_sudorule_command (string)</term>
+                    <listitem>
+                        <para>
+                            The LDAP attribute that corresponds to the
+                            command name.
+                        </para>
+                        <para>
+                            Default: sudoCommand
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>ldap_sudorule_host (string)</term>
+                    <listitem>
+                        <para>
+                            The LDAP attribute that corresponds to the
+                            host name.
+                        </para>
+                        <para>
+                            Default: sudoHost
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>ldap_sudorule_user (string)</term>
+                    <listitem>
+                        <para>
+                            The LDAP attribute that corresponds to the
+                            user name.
+                        </para>
+                        <para>
+                            Default: sudoUser
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>ldap_sudorule_option (string)</term>
+                    <listitem>
+                        <para>
+                            The LDAP attribute that corresponds to the
+                            sudo options.
+                        </para>
+                        <para>
+                            Default: sudoOption
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>ldap_sudorule_runasuser (string)</term>
+                    <listitem>
+                        <para>
+                            The LDAP attribute that corresponds to the
+                            user name that commands may be run as.
+                        </para>
+                        <para>
+                            Default: sudoRunAsUser
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>ldap_sudorule_runasgroup (string)</term>
+                    <listitem>
+                        <para>
+                            The LDAP attribute that corresponds to the
+                            group name that commands may be run as.
+                        </para>
+                        <para>
+                            Default: sudoRunAsGroup
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>ldap_sudorule_notbefore (string)</term>
+                    <listitem>
+                        <para>
+                            The LDAP attribute that corresponds to the
+                            start date/time for when the sudo rule is valid.
+                        </para>
+                        <para>
+                            Default: sudoNotBefore
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>ldap_sudorule_notafter (string)</term>
+                    <listitem>
+                        <para>
+                            The LDAP attribute that corresponds to the
+                            expiration date/time, after which the sudo rule
+                            will no longer be valid.
+                        </para>
+                        <para>
+                            Default: sudoNotAfter
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>ldap_sudorule_order (string)</term>
+                    <listitem>
+                        <para>
+                            The LDAP attribute that corresponds to the
+                            ordering index of the rule.
+                        </para>
+                        <para>
+                            Default: sudoOrder
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>ldap_sudo_refresh_enabled (boolean)</term>
+                    <listitem>
+                        <para>
+                            Enables periodical download of all sudo rules.
+                            The cache is purged before each update.
+                        </para>
+                        <para>
+                            Default: false
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>ldap_sudo_refresh_timeout (integer)</term>
+                    <listitem>
+                        <para>
+                            How many seconds SSSD has to wait before refreshing
+                            its cache of sudo rules.
+                        </para>
+                        <para>
+                            Default: 300
+                        </para>
+                    </listitem>
+                </varlistentry>
+
             </variablelist>
         </para>
     </refsect1>
@@ -1666,6 +1835,25 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
                     </listitem>
                 </varlistentry>
 
+                <varlistentry>
+                    <term>ldap_sudo_search_base (string)</term>
+                    <listitem>
+                        <para>
+                            An optional base DN to restrict sudo rules searches
+                            to a specific subtree.
+                        </para>
+                        <para>
+                            See <quote>ldap_search_base</quote> for
+                            information about configuring multiple search
+                            bases.
+                        </para>
+                        <para>
+                            Default: the value of
+                            <emphasis>ldap_search_base</emphasis>
+                        </para>
+                    </listitem>
+                </varlistentry>
+
             </variablelist>
         </para>
     </refsect1>
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 72998b44f6637734e372b26eb7889b220ce8ac36..93f82303558ccb8764efea7ccdff9367bdca45c0 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -85,7 +85,7 @@
                                 started when sssd itself starts.
                             </para>
                             <para>
-                                Supported services: nss, pam
+                                Supported services: nss, pam, sudo
                             </para>
                         </listitem>
                     </varlistentry>
@@ -866,6 +866,29 @@
                         </para>
                     </listitem>
                 </varlistentry>
+                <varlistentry>
+                    <term>sudo_provider (string)</term>
+                    <listitem>
+                        <para>
+                            The SUDO provider used for the domain.
+                            Supported SUDO providers are:
+                        </para>
+                        <para>
+                            <quote>ldap</quote> for rules stored in LDAP. See
+                            <citerefentry>
+                                <refentrytitle>sssd-ldap</refentrytitle>
+                                <manvolnum>5</manvolnum>
+                            </citerefentry> for more information on configuring LDAP.
+                        </para>
+                        <para>
+                            <quote>none</quote> disables SUDO explicitly.
+                        </para>
+                        <para>
+                            Default: <quote>id_provider</quote> is used if it
+                            is set.
+                        </para>
+                    </listitem>
+                </varlistentry>
 
                 <varlistentry>
                     <term>lookup_family_order (string)</term>
-- 
1.7.7.6

-------------- next part --------------
From 6d35e1968047767d1870d5aaeac52befc9aa982c Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Sun, 29 Jan 2012 22:11:45 +0100
Subject: [PATCH 2/2] Include sudo manual pages only conditionally

---
 src/man/Makefile.am     |   13 +++++++++++--
 src/man/sssd-ldap.5.xml |   31 +++++++++++++++++++++++++------
 src/man/sssd.conf.5.xml |   11 ++++++++---
 3 files changed, 44 insertions(+), 11 deletions(-)

diff --git a/src/man/Makefile.am b/src/man/Makefile.am
index 09af8985f50d290617c3b72f9d7a43b128bc4340..36c3921d18ce542c43c97b616942fbc79c532d1b 100644
--- a/src/man/Makefile.am
+++ b/src/man/Makefile.am
@@ -5,11 +5,20 @@ top_builddir = ../..
 # MANPAGES #
 ############
 
+
+# If no conditions are given, *all* conditionals are expanded. We don't
+# to include any conditions by default, so we need to pass a phony conditional
+CONDS=with_false
+if BUILD_SUDO
+# conditionals are delimeted with a semicolon
+CONDS+=;with_sudo
+endif
+
 #Special Rules:
 export SGML_CATALOG_FILES
-DOCBOOK_XSLT = http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl
+DOCBOOK_XSLT = http://docbook.sourceforge.net/release/xsl/current/manpages/profile-docbook.xsl
 XMLLINT_FLAGS = --catalogs --postvalid --nonet --xinclude --noout
-XSLTPROC_FLAGS = --catalogs --xinclude --nonet
+XSLTPROC_FLAGS = --stringparam profile.condition "$(CONDS)" --catalogs --xinclude --nonet
 
 man_MANS = \
     sss_useradd.8 sss_userdel.8 sss_usermod.8 \
diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 5afa9ad7942f8b57431965ef0e580a8def0fc0bb..3228e624cf2bc0a18c18bfeec3d029254b3d3e68 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -1553,7 +1553,15 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
                         </para>
                     </listitem>
                 </varlistentry>
+            </variablelist>
+        </para>
+    </refsect1>
 
+    <refsect1 id='sudo-options' condition="with_sudo">
+        <title>SUDO OPTIONS</title>
+        <para>
+        <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/experimental.xml" />
+            <variablelist>
                 <varlistentry>
                     <term>ldap_sudorule_object_class (string)</term>
                     <listitem>
@@ -1597,7 +1605,8 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
                     <listitem>
                         <para>
                             The LDAP attribute that corresponds to the
-                            host name.
+                            host name (or host IP address, host IP network,
+                            or host netgroup)
                         </para>
                         <para>
                             Default: sudoHost
@@ -1610,7 +1619,7 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
                     <listitem>
                         <para>
                             The LDAP attribute that corresponds to the
-                            user name.
+                            user name (or UID, group name or user's netgroup)
                         </para>
                         <para>
                             Default: sudoUser
@@ -1648,8 +1657,8 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
                     <term>ldap_sudorule_runasgroup (string)</term>
                     <listitem>
                         <para>
-                            The LDAP attribute that corresponds to the
-                            group name that commands may be run as.
+                            The LDAP attribute that corresponds to the group
+                            name or group GID that commands may be run as.
                         </para>
                         <para>
                             Default: sudoRunAsGroup
@@ -1722,9 +1731,16 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
                         </para>
                     </listitem>
                 </varlistentry>
-
             </variablelist>
         </para>
+        <para>
+            This manual page only describes attribute name mapping.
+            For detailed explanation of sudo related attribute sematics,
+            see
+            <citerefentry>
+                <refentrytitle>sudoers.ldap</refentrytitle><manvolnum>5</manvolnum>
+            </citerefentry>
+        </para>
     </refsect1>
 
     <refsect1 id='advanced-options'>
@@ -1835,7 +1851,7 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
                     </listitem>
                 </varlistentry>
 
-                <varlistentry>
+                <varlistentry condition="with_sudo">
                     <term>ldap_sudo_search_base (string)</term>
                     <listitem>
                         <para>
@@ -1851,6 +1867,9 @@ ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
                             Default: the value of
                             <emphasis>ldap_search_base</emphasis>
                         </para>
+                        <para>
+                            <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/experimental.xml" />
+                        </para>
                     </listitem>
                 </varlistentry>
 
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 93f82303558ccb8764efea7ccdff9367bdca45c0..fee40a6a14ae6a9ea7282a1f80b1e83c13370d02 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -85,7 +85,8 @@
                                 started when sssd itself starts.
                             </para>
                             <para>
-                                Supported services: nss, pam, sudo
+                                Supported services: nss, pam
+                                <phrase condition="with_sudo">, sudo</phrase>
                             </para>
                         </listitem>
                     </varlistentry>
@@ -866,10 +867,14 @@
                         </para>
                     </listitem>
                 </varlistentry>
-                <varlistentry>
+
+                <varlistentry condition="with_sudo">
                     <term>sudo_provider (string)</term>
                     <listitem>
                         <para>
+                            <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/experimental.xml" />
+                        </para>
+                        <para>
                             The SUDO provider used for the domain.
                             Supported SUDO providers are:
                         </para>
@@ -884,7 +889,7 @@
                             <quote>none</quote> disables SUDO explicitly.
                         </para>
                         <para>
-                            Default: <quote>id_provider</quote> is used if it
+                            Default: The value of <quote>id_provider</quote> is used if it
                             is set.
                         </para>
                     </listitem>
-- 
1.7.7.6



More information about the sssd-devel mailing list