3

I was reading through the sudoers policy manual. Under 'User specification' section, I saw Date_Spec as part of the Option_Spec, in turn an optional part of the Cmnd_Spec.

 User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \
               (':' Host_List '=' Cmnd_Spec_List)*

 Cmnd_Spec_List ::= Cmnd_Spec |
                    Cmnd_Spec ',' Cmnd_Spec_List

 Cmnd_Spec ::= Runas_Spec? Option_Spec* Tag_Spec* Cmnd

 Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')'

 Option_Spec ::= (Date_Spec | Timeout_Spec)

 Date_Spec ::= ('NOTBEFORE=timestamp' | 'NOTAFTER=timestamp')

 Timeout_Spec ::= 'TIMEOUT=timeout'

What does this do? From my reading, it looks like something I can use to restrict the time span within which a user can run a command. Is that correct? If so, what are the possible use cases for such a feature?

Ref: man 5 sudoers

3

Support for the Date_Spec appears to have been added in version 1.8.20, with the Changelog indicating that it the code was changed by 2017-02-18:

Add NOTBEFORE and NOTAFTER command options similar to what is already available in LDAP.

The option does exactly as you guessed: restricts the corresponding rule to have a start and/or end date.

For example, I added this rule:

jeff2 ALL=(ALL) NOTBEFORE=20190409212700 /bin/ps

and then executed the following as jeff2:

$ sudo -l
# ... elided ...
User jeff2 may run the following commands on r2d2:
    (ALL) /bin/ls
    (ALL) NOTBEFORE=20190410012700Z /bin/ps
$ date -u '+%Y%m%d %H:%M:%S'
20190410 01:25:52
$ sudo /bin/ps
Sorry, user jeff2 is not allowed to execute '/bin/ps' as root on r2d2.
$ sleep 2m   ## plus get distracted by something
$ date -u '+%Y%m%d %H:%M:%S'
20190410 01:29:33
$ sudo /bin/ps
  PID TTY          TIME CMD
 9607 pts/1    00:00:00 ps

I can see a use-case for this where you want to grant temporary additional access (say for a specific application upgrade or change), but you don't want to have to remember to log in before and after that timeframe to update sudoers. Perhaps you have a privileged user that's changing roles and no longer needs certain commands after a certain date; you could use NOTAFTER at your convenience, then go in later and delete the rules at some point later. Similarly with NOTBEFORE for someone changing roles into one that is a more privileged.

  • Thanks, I'm also assuming you can do this to multiple commands? Like jeff2 can't run ps after Monday and he can't run ping after Tuesday? I wonder why this is feature is not more popular. Seems like a handy thing. I need to read the man page more carefully and understand this better. – eternaltyro Apr 10 at 18:06
  • 1
    Correct in your assumption; the Date_Spec is part of the Option_Spec which is part of the Cmnd_Spec, which is a comma-separated list of "commands", so ps could have a different Date_Spec than ping, for your example. I have not yet seen Date_Spec in the wild, myself, maybe because that feature is relatively new (in the non-LDAP world). In fact, I had to compile a newer version of sudo on that Debian "stable" VM in order to test my Answer. – Jeff Schaller Apr 10 at 18:18
  • I'm about to test this in Debian 9. Date_Spec is not in the default compile options? – eternaltyro Apr 11 at 1:46
  • 1
    The sudo version in Stretch:stable is 1.8.19p1, which predates the introduction of Date_Spec in 1.8.20 by just a few months. Unstable has v1.8.27. – Jeff Schaller Apr 11 at 2:05
  • Hold on, isn't sudoers a policy plugin for sudo? How's that dependent on sudo itself? I thought the onus of implementation was on the plugin itself. – eternaltyro Apr 11 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.