···

       
5
       
5
       
 
       
  password = "helloworld";

     

       
6
       
6
       
 
       
in

     

       
7
       
7
       
 
       
  import ./make-test-python.nix ({ lib, pkgs, ...} : {

     

       
8
       
8
       
-
       
    name = "sudo";

     

       
8
       
8
       
+
       
    name = "sudo-rs";

     

       
9
       
9
       
 
       
    meta.maintainers = pkgs.sudo-rs.meta.maintainers;

     

       
10
       
10
       
 
       


     

       
11
       
11
       
 
       
    nodes.machine =

     
···

       
22
       
22
       
 
       
          test5 = { isNormalUser = true; };

     

       
23
       
23
       
 
       
        };

     

       
24
       
24
       
 
       


     

       
25
       
25
       
-
       
        security.sudo = {

     

       
25
       
25
       
+
       
        security.sudo.enable = false;

     

       
26
       
26
       
+
       


     

       
27
       
27
       
+
       
        security.sudo-rs = {

     

       
26
       
28
       
 
       
          enable = true;

     

       
27
       
29
       
 
       
          package = pkgs.sudo-rs;

     

       
28
       
30
       
 
       
          wheelNeedsPassword = false;

     
···

       
54
       
56
       
 
       
        noadmin = { isNormalUser = true; };

     

       
55
       
57
       
 
       
      };

     

       
56
       
58
       
 
       


     

       
57
       
57
       
-
       
      security.sudo = {

     

       
59
       
59
       
+
       
      security.sudo.enable = false;

     

       
60
       
60
       
+
       


     

       
61
       
61
       
+
       
      security.sudo-rs = {

     

       
58
       
62
       
 
       
        package = pkgs.sudo-rs;

     

       
59
       
63
       
 
       
        enable = true;

     

       
60
       
64
       
 
       
        wheelNeedsPassword = false;

     
···

       
86
       
90
       
 
       
            machine.succeed("sudo -u test5 sudo -n -u test1 true")

     

       
87
       
91
       
 
       


     

       
88
       
92
       
 
       
        with subtest("test5 user should not be able to run commands under root"):

     

       
89
       
89
       
-
       
            machine.fail("sudo -u test5 sudo -n -u root true")

     

       
93
       
93
       
+
       
            machine.fail("sudo -u test5 sudo -n -u root true 2>/dev/null")

     

       
90
       
94
       
 
       


     

       
91
       
95
       
 
       
        with subtest("users in wheel should be able to run sudo despite execWheelOnly"):

     

       
92
       
96
       
 
       
            strict.succeed('faketty -- su - admin -c "sudo -u root true"')