sudo: Add ldap support for sudoers rules
PATCH 1/2 sudo: Add ldap support for sudoers rules
Added Config.in options to enable/disable the option, and check options in sudo.mk to add openldap as a dependancy and compile with --with-ldap.
--- package/sudo/Config.in | 12 ++++++++++++ package/sudo/sudo.mk | 5 +++++ 2 files changed, 17 insertions(+)
package/sudo/Config.in +12 -0
@@ -9,3 +9,15 @@ config BR2_PACKAGE_SUDO but still allow people to get their work done. http://www.sudo.ws/sudo/ + +if BR2_PACKAGE_SUDO && BR2_PACKAGE_OPENLDAP +config BR2_PACKAGE_SUDO_LDAP + bool "ldap integration" + depends on BR2_PACKAGE_SUDO + help + Allows you to manage sudoers rules in a centralized ldap + directory. + + http://www.sudo.ws/man/1.8.15/sudoers.ldap.man.html +endif +
package/sudo/sudo.mk +5 -0
@@ -30,6 +30,11 @@ else SUDO_CONF_OPTS += --without-pam endif +ifeq ($(BR2_PACKAGE_SUDO_LDAP),y) +SUDO_DEPENDENCIES += openldap +SUDO_CONF_OPTS += --with-ldap +endif + # mksigname/mksiglist needs to run on build host to generate source files define SUDO_BUILD_MKSIGNAME_MKSIGLIST_HOST $(MAKE) $(HOST_CONFIGURE_OPTS) \
Signature · 1 line
2.7.3
PATCH 2/2 postgresql: enable ldap support for pg_service.conf
Just needed to add --with-ldap to POSTGRESQL_CONF_OPTS and add openldap to POSTGRESQL_DEPENDENCIES when BR2_PACKAGE_OPENLDAP is on
--- package/postgresql/postgresql.mk | 5 +++++ 1 file changed, 5 insertions(+)
package/postgresql/postgresql.mk +5 -0
@@ -57,6 +57,11 @@ POSTGRESQL_DEPENDENCIES += openssl POSTGRESQL_CONF_OPTS += --with-openssl endif +ifeq ($(BR2_PACKAGE_OPENLDAP),y) +POSTGRESQL_DEPENDENCIES += openldap +POSTGRESQL_CONF_OPTS += --with-ldap +endif + define POSTGRESQL_USERS postgres -1 postgres -1 * /var/lib/pgsql /bin/sh - PostgreSQL Server endef
Signature · 1 line
2.7.3
PATCH 2/2 postgresql: enable ldap support for pg_service.conf
Hello Chris,
Quoted 14 lines · Chris Frederick
Just needed to add --with-ldap to
POSTGRESQL_CONF_OPTSand add openldap toPOSTGRESQL_DEPENDENCIESwhenBR2_PACKAGE_OPENLDAPis onSigned-off-by Chris Frederick <[email protected]>--- package/postgresql/postgresql.mk | 5 +++++ 1 file changed, 5 insertions(+)package/postgresql/postgresql.mk +0
-0@@ -57,6 +57,11 @@ POSTGRESQL_DEPENDENCIES += openssl POSTGRESQL_CONF_OPTS += --with-openssl
package/postgresql/postgresql.mk POSTGRESQL_DEPENDENCIES += openssl · line 67
Quoted 10 lines
package/postgresql/postgresql.mk +5
-0endif +ifeq ($(BR2_PACKAGE_OPENLDAP),y) +POSTGRESQL_DEPENDENCIES += openldap +POSTGRESQL_CONF_OPTS += --with-ldap +endif + define POSTGRESQL_USERS postgres -1 postgres -1 * /var/lib/pgsql /bin/sh - PostgreSQL Server endef
Compile tested (and checked for the 'build with LDAP support... yes' configure output).
Regards,
Peter
PATCH 2/2 postgresql: enable ldap support for pg_service.conf
In reply to Chris FrederickQuoted 13 lines · Chris Frederick
Just needed to add --with-ldap to
POSTGRESQL_CONF_OPTSand add openldap toPOSTGRESQL_DEPENDENCIESwhenBR2_PACKAGE_OPENLDAPis onSigned-off-by Chris Frederick <[email protected]>--- package/postgresql/postgresql.mk | 5 +++++ 1 file changed, 5 insertions(+)package/postgresql/postgresql.mk +0
-0
package/postgresql/postgresql.mk POSTGRESQL_DEPENDENCIES += openssl · line 62
Quoted 6 lines
package/postgresql/postgresql.mk +3
-0@@ -57,6 +57,11 @@ POSTGRESQL_DEPENDENCIES += openssl POSTGRESQL_CONF_OPTS += --with-openssl endif +ifeq ($(BR2_PACKAGE_OPENLDAP),y) +POSTGRESQL_DEPENDENCIES += openldap +POSTGRESQL_CONF_OPTS += --with-ldap
Same here: add --without-ldap.
Regards,
Arnout
Quoted 6 lines
package/postgresql/postgresql.mk +2
-0+endif + define POSTGRESQL_USERS postgres -1 postgres -1 * /var/lib/pgsql /bin/sh - PostgreSQL Server endef
Signature · 6 lines
Arnout Vandecappelle arnout at mind be Senior Embedded Software Architect +32-16-286500 Essensium/Mind http://www.mind.be G.Geenslaan 9, 3001 Leuven, Belgium BE 872 984 063 RPR Leuven LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle GPG fingerprint: 7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF
PATCH 2/2 postgresql: enable ldap support for pg_service.conf
Hello Arnout, Chris,
Quoted 19 lines · Arnout Vandecappelle
Quoted 16 lines · Chris Frederick
Just needed to add --with-ldap to
POSTGRESQL_CONF_OPTSand add openldap toPOSTGRESQL_DEPENDENCIESwhenBR2_PACKAGE_OPENLDAPis onSigned-off-by Chris Frederick <[email protected]>--- package/postgresql/postgresql.mk | 5 +++++ 1 file changed, 5 insertions(+)package/postgresql/postgresql.mk +0
-0@@ -57,6 +57,11 @@ POSTGRESQL_DEPENDENCIES += openssl POSTGRESQL_CONF_OPTS += --with-openssl endif
Quoted 5 lines
package/postgresql/postgresql.mk POSTGRESQL_DEPENDENCIES += openssl · line 62
Quoted 3 lines
package/postgresql/postgresql.mk +3
-0+ifeq ($(BR2_PACKAGE_OPENLDAP),y) +POSTGRESQL_DEPENDENCIES += openldap +POSTGRESQL_CONF_OPTS += --with-ldapSame here: add --without-ldap.
Not needed for this option (as with openssl), because there is no auto detection in case the option is not given (as opposed to the readline and zlib options), see [1] for discussion of this...
Should have added a comment about this back in 2014...
Regards,
Peter
[1] http://lists.busybox.net/pipermail/buildroot/2014-March/093215.html
Quoted 11 lines
Regards,
ArnoutQuoted 6 lines
package/postgresql/postgresql.mk +2
-0+endif + define POSTGRESQL_USERS postgres -1 postgres -1 * /var/lib/pgsql /bin/sh - PostgreSQL Server endef
PATCH 1/2 sudo: Add ldap support for sudoers rules
In reply to Chris FrederickHi Chris,
Thank you for your patch. I have a few comments below. Can you fix and
resubmit? I have marked your patch as "Changes Requested" in our patch tracking system so if you don't resubmit we will forget about it.
Quoted 14 lines · Chris Frederick
Added Config.in options to enable/disable the option, and check options in sudo.mk to add openldap as a dependancy and compile with --with-ldap.
Signed-off-by Chris Frederick <[email protected]>--- package/sudo/Config.in | 12 ++++++++++++ package/sudo/sudo.mk | 5 +++++ 2 files changed, 17 insertions(+)package/sudo/Config.in +0
-0
package/sudo/Config.in config BR2_PACKAGE_SUDO · line 14
Quoted 6 lines
package/sudo/Config.in +3
-0@@ -9,3 +9,15 @@ config BR2_PACKAGE_SUDO but still allow people to get their work done. http://www.sudo.ws/sudo/ + +if BR2_PACKAGE_SUDO && BR2_PACKAGE_OPENLDAP +config BR2_PACKAGE_SUDO_LDAP
As far as I know, there is no need to make this option configurable. Just
enable LDAP support when BR2_PACKASGE_OPENLDAP is selected, like you do for postgresql.
Quoted 14 lines
package/sudo/Config.in +9
-0+ bool "ldap integration" + depends on BR2_PACKAGE_SUDO + help + Allows you to manage sudoers rules in a centralized ldap + directory. + + http://www.sudo.ws/man/1.8.15/sudoers.ldap.man.html +endif +package/sudo/sudo.mk +0
-0
package/sudo/sudo.mk else · line 35
Quoted 6 lines
package/sudo/sudo.mk +3
-0@@ -30,6 +30,11 @@ else SUDO_CONF_OPTS += --without-pam endif +ifeq ($(BR2_PACKAGE_SUDO_LDAP),y) +SUDO_DEPENDENCIES += openldap +SUDO_CONF_OPTS += --with-ldap
We also prefer to explicitly disable options, to avoid problems with e.g.
looking up on the host. So add
elseSUDO_CONF_OPTS += --without-ldap
or if that is not possible, a comment why not.
Regards,
Arnout
Quoted 6 lines
package/sudo/sudo.mk +2
-0+endif + # mksigname/mksiglist needs to run on build host to generate source files define SUDO_BUILD_MKSIGNAME_MKSIGLIST_HOST $(MAKE) $(HOST_CONFIGURE_OPTS) \
Signature · 6 lines
Arnout Vandecappelle arnout at mind be Senior Embedded Software Architect +32-16-286500 Essensium/Mind http://www.mind.be G.Geenslaan 9, 3001 Leuven, Belgium BE 872 984 063 RPR Leuven LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle GPG fingerprint: 7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF
PATCH 1/2 sudo: Add ldap support for sudoers rules
Hi Arnout,
Comments below...
Quoted 23 lines · Arnout Vandecappelle
Hi Chris,
Thank you for your patch. I have a few comments below. Can you fix and
resubmit? I have marked your patch as "Changes Requested" in our patch tracking system so if you don't resubmit we will forget about it.Quoted 16 lines · Chris Frederick
Added Config.in options to enable/disable the option, and check options in sudo.mk to add openldap as a dependancy and compile with --with-ldap.
Signed-off-by Chris Frederick <[email protected]>--- package/sudo/Config.in | 12 ++++++++++++ package/sudo/sudo.mk | 5 +++++ 2 files changed, 17 insertions(+)package/sudo/Config.in +0
-0@@ -9,3 +9,15 @@ config BR2_PACKAGE_SUDO but still allow people to get their work done.
Quoted 8 lines
package/sudo/Config.in config BR2_PACKAGE_SUDO · line 14
Quoted 4 lines
package/sudo/Config.in +3
-0http://www.sudo.ws/sudo/ + +if BR2_PACKAGE_SUDO && BR2_PACKAGE_OPENLDAP +config BR2_PACKAGE_SUDO_LDAPAs far as I know, there is no need to make this option configurable. Just
enable LDAP support whenBR2_PACKASGE_OPENLDAPis selected, like you do for postgresql.
From my experience with sudo built with ldap, it stops checking /etc/sudoers for rules and instead looks for /etc/ldap.conf. According to the link in the help text, /etc/sudoers is only read for defaults, everything else needs to come from ldap. And if /etc/ldap.conf hasn't been configured by the user, sudo will fail with a "no valid sudoers sources found" error. So I wanted to make sure a user explicitly selected the option. That's just been my experience using this in buildroot and gentoo. I should probably add that to the help.
How about this:
help:
Allows you to manage sudoers rules in a centralized ldap directory. This restricts the /etc/sudoers file from defining rules, only defaults will be read. All rules will need to be provided via ldap configured in /etc/ldap.conf
http://www.sudo.ws/man/1.8.15/sudoers.ldap.man.html
Quoted 24 lines
Quoted 14 lines
package/sudo/Config.in +9
-0+ bool "ldap integration" + depends on BR2_PACKAGE_SUDO + help + Allows you to manage sudoers rules in a centralized ldap + directory. + + http://www.sudo.ws/man/1.8.15/sudoers.ldap.man.html +endif +package/sudo/sudo.mk +0
-0package/sudo/sudo.mk else · line 35
Quoted 6 lines
package/sudo/sudo.mk +3
-0@@ -30,6 +30,11 @@ else SUDO_CONF_OPTS += --without-pam endif +ifeq ($(BR2_PACKAGE_SUDO_LDAP),y) +SUDO_DEPENDENCIES += openldap +SUDO_CONF_OPTS += --with-ldapWe also prefer to explicitly disable options, to avoid problems with e.g.
looking up on the host. So add
Quoted 2 lines
else
SUDO_CONF_OPTS+= --without-ldap
Will do.
Quoted 12 lines
or if that is not possible, a comment why not.
Regards,
ArnoutQuoted 6 lines
package/sudo/sudo.mk +2
-0+endif + # mksigname/mksiglist needs to run on build host to generate source files define SUDO_BUILD_MKSIGNAME_MKSIGLIST_HOST $(MAKE) $(HOST_CONFIGURE_OPTS) \
PATCH 1/2 sudo: Add ldap support for sudoers rules
Quoted 43 lines · Chris Frederick
Hi Arnout,
Comments below...
Quoted 23 lines · Arnout Vandecappelle
Quoted 23 lines
Hi Chris,
Thank you for your patch. I have a few comments below. Can you fix and
resubmit? I have marked your patch as "Changes Requested" in our patch tracking system so if you don't resubmit we will forget about it.Quoted 16 lines · Chris Frederick
Quoted 16 lines
Added Config.in options to enable/disable the option, and check options in sudo.mk to add openldap as a dependancy and compile with --with-ldap.
Signed-off-by Chris Frederick <[email protected]>--- package/sudo/Config.in | 12 ++++++++++++ package/sudo/sudo.mk | 5 +++++ 2 files changed, 17 insertions(+)package/sudo/Config.in +0
-0@@ -9,3 +9,15 @@ config BR2_PACKAGE_SUDO but still allow people to get their work done.Quoted 8 lines
Quoted 8 lines
Quoted 4 lines
package/sudo/Config.in config BR2_PACKAGE_SUDO · line 14
Quoted 4 lines
package/sudo/Config.in +3
-0http://www.sudo.ws/sudo/ + +if BR2_PACKAGE_SUDO && BR2_PACKAGE_OPENLDAP +config BR2_PACKAGE_SUDO_LDAPAs far as I know, there is no need to make this option configurable. Just
enable LDAP support whenBR2_PACKASGE_OPENLDAPis selected, like you do for postgresql.From my experience with sudo built with ldap, it stops checking
/etc/sudoersfor rules and instead looks for/etc/ldap.conf. According to the link in the help text,/etc/sudoersis only read for defaults, everything else needs to come from ldap. And if/etc/ldap.confhasn't been configured by the user, sudo will fail with a "no valid sudoers sources found" error. So I wanted to make sure a user explicitly selected the option. That's just been my experience using this in buildroot and gentoo. I should probably add that to the help.How about this:
Quoted 7 lines
help:
Allows you to manage sudoers rules in a centralized ldap directory. This restricts the/etc/sudoersfile from defining rules, only defaults will be read. All rules will need to be provided via ldap configured in/etc/ldap.conf
OK, then indeed it's better to make it an option.
One small coding style nit: write it like:
if BR2_PACKAGE_SUDO
config BR2_PACKAGE_SUDO_LDAP
depends on BR2_PACKAGE_OPENLDAP
so future sudo extensions can reuse the same conditions - not likely, but htis is the pattern that we follow everywhere else.
Normally we would use 'select' instead of 'depends on', but in this case
'depends' is indeed better.
Please also summarise the above in the commit message. And you can add the
following to the commit message too:
Since the user explicitly has to provide /etc/ldap.conf, we use 'depends on' so that the user is obliged to explicitly enable openldap before the option becomes visible.
Regards,
Arnout
Signature · 6 lines
Arnout Vandecappelle arnout at mind be Senior Embedded Software Architect +32-16-286500 Essensium/Mind http://www.mind.be G.Geenslaan 9, 3001 Leuven, Belgium BE 872 984 063 RPR Leuven LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle GPG fingerprint: 7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF