Package: sudo
Distro: trixie (stable)
In a sudoers.d file for a specific user, I added a spec:
> {user} ALL=({username}) {command-path} {command arg}
(note that braces here means "not literally"...)
Execution of sudo for that user would be rejected.
> {user} ALL=({username}) {command-path}
That would be accepted! (omit the args...) Problem is: the argument is
important to implement a "least-privilege" policy (it restricts a user to a
specific database...)
The sudoers parsing of the sudo package appears to be doing something weird
with regards to the command+command args. I tried various quoting and escaping,
and it still would not work...
