ducoterra
d9925b931d
Passwordless sudo access scoped to specific commands (dnf, systemctl, firewall-cmd, ansible, qemu/virt, btrfs, acl) for ansible and maintenance automations on the fedora host. LLM-Generated: true
59 lines
1.7 KiB
Plaintext
59 lines
1.7 KiB
Plaintext
# This is the sudoers file for the ops user to give limited access to specific commands without a password
|
|
# Used for automations like ansible and maintenance
|
|
|
|
# Hostname
|
|
ops ALL=(root) NOPASSWD: /usr/bin/hostnamectl hostname *
|
|
|
|
# Reboot
|
|
ops ALL=(root) NOPASSWD: /usr/bin/reboot
|
|
|
|
# System updates
|
|
ops ALL=(root) NOPASSWD: /usr/bin/dnf update*, /usr/bin/dnf upgrade*, /usr/bin/dnf install *, /usr/bin/dnf remove *
|
|
|
|
# Package cache management
|
|
ops ALL=(root) NOPASSWD: /usr/bin/dnf clean all, /usr/bin/dnf makecache, /usr/bin/dnf autoremove
|
|
|
|
# Repos
|
|
ops ALL=(root) NOPASSWD: /usr/bin/dnf config-manager addrepo *
|
|
|
|
# Service management
|
|
ops ALL=(root) NOPASSWD: /usr/bin/systemctl start *, /usr/bin/systemctl restart *, /usr/bin/systemctl reload *, /usr/bin/systemctl enable *
|
|
|
|
# Firewall
|
|
ops ALL=(root) NOPASSWD: /usr/bin/firewall-cmd *
|
|
|
|
# Ansible
|
|
ops ALL=(root) NOPASSWD: /bin/sh -c echo BECOME-SUCCESS-* ; /usr/bin/python3 /home/ops/.ansible*
|
|
|
|
# qemu-img
|
|
ops ALL=(root) NOPASSWD: /usr/bin/qemu-img *
|
|
|
|
# virsh
|
|
ops ALL=(root) NOPASSWD: /usr/bin/virsh *
|
|
|
|
# virt-install
|
|
ops ALL=(root) NOPASSWD: /usr/bin/virt-install *
|
|
|
|
# composer-cli
|
|
ops ALL=(root) NOPASSWD: /usr/bin/composer-cli *
|
|
|
|
# osbuild
|
|
ops ALL=(root) NOPASSWD: /usr/local/bin/osbuild-auto.sh
|
|
|
|
# getfacl
|
|
ops ALL=(root) NOPASSWD: /usr/sbin/getfacl*
|
|
|
|
# set default rwx sbin
|
|
ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -d -m u\:ops\:rwx /usr/local/sbin
|
|
|
|
# set existing rwx sbin
|
|
ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -m u\:ops\:rwx /usr/local/sbin
|
|
|
|
# set default rwx /srv
|
|
ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -d -m u\:ops\:rwx /srv/*
|
|
|
|
# set existing rwx /srv
|
|
ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -m u\:ops\:rwx /srv/*
|
|
|
|
# Start btrfs scrub
|
|
ops ALL=(root) NOPASSWD: /usr/bin/btrfs scrub* |