f5988eceea
Provide log access to users of the groups sys_admin,
sys_configurator, sys_operator, and sys_reader.
This change adds read permission so that the users
of sys_* groups can access logs at /var/log
Test Plan:
PASS: Build iso and deploy.
PASS: AIO-SX: create a user and add to sys_operator
group. Verify if the user have access to log files.
Ensure the user can view the log files using
cat/less and edit them using vim.
PASS: AIO-SX: create a user and add to sys_reader
group. Verify if the user have access to log files.
Ensure the user can view the log files using
cat/less and edit them using vim.
PASS: AIO-SX: create a user and add to sys_configurator
group. Verify if the user have access to log files.
Ensure the user can view the log files using
cat/less and edit them using vim.
PASS: AIO-SX: create a user and add to sys_admin
group. Verify if the user have access to log files.
Ensure the user can view the log files using
cat/less and edit them using vim.
Story: 2011241
Task: 51208
Depends-On: https://review.opendev.org/c/starlingx/stx-puppet/+/932168
Change-Id: Icaeca4559cd84d3843fe2024430ff5726640cae6
Signed-off-by: Jagatguru Prasad Mishra <jagatguruprasad.mishra@windriver.com>
18 lines
1.0 KiB
Plaintext
18 lines
1.0 KiB
Plaintext
# User alias specification
|
|
User_Alias ALL_SYS_GROUPS = %sys_admin, %sys_configurator, %sys_operator, %sys_reader
|
|
|
|
# Cmnd alias specification
|
|
Cmnd_Alias CAT_LOGS = /usr/bin/ls /var/log/*, /usr/bin/cat /var/log/*.log
|
|
Cmnd_Alias GUNZIP_LOGS = /usr/bin/gunzip /var/log/*.gz, /usr/bin/cat /var/log/*.log.[0-9]*
|
|
Cmnd_Alias VIM_LOGS = /usr/bin/vim /var/log/*.log, /usr/bin/vim /var/log/*.log.[0-9]*
|
|
Cmnd_Alias LESS_LOGS = /usr/bin/less /var/log/*.log, /usr/bin/less /var/log/*.log.[0-9]*
|
|
|
|
# Allow members of all sys_* groups to execute selected commands
|
|
ALL_SYS_GROUPS ALL=(root:root) NOPASSWD: CAT_LOGS, VIM_LOGS, LESS_LOGS
|
|
# Allow members of all sys_admin groups to execute selected commands
|
|
%sys_admin ALL=(root:root) NOPASSWD: GUNZIP_LOGS
|
|
# Allow members of all sys_configurator groups to execute selected commands
|
|
%sys_configurator ALL=(root:root) NOPASSWD: GUNZIP_LOGS
|
|
# Allow members of all sys_operator groups to execute selected commands
|
|
%sys_operator ALL=(root:root) NOPASSWD: GUNZIP_LOGS
|