50 lines
2.9 KiB
YAML
50 lines
2.9 KiB
YAML
# Stop sudo from recording the DATA of bulk-copy commands run by infra-ops (Prime 2026-10-04: "we need to stop that …
|
|
# we don't need to durably back up weights and rsyncs forever").
|
|
# scripts/elway infra-ops@<host> --playbook playbooks/sudoers-infra-ops-bulk-no-log-output.yaml
|
|
#
|
|
# Why: `Defaults:infra-ops log_output` records every byte a sudo'd command prints. That turned a `sudo tar` of a
|
|
# model directory into a 14.45 G session on fv-ml1 and a nightly ~380 M `sudo rsync --server --sender` of the Home
|
|
# Assistant volume into 30+ sessions on esh-docker-vm. With this, those commands are still logged (sudo's syslog line
|
|
# says who ran what, when, as whom); only their output stream is no longer recorded. Everything else stays recorded.
|
|
# The list: rsync/tar/cat/dd/compressors/pv move data; `docker save|export|cp` dump images and container files.
|
|
# Only touches hosts whose infra-ops sudoers already has log_output; the new file is visudo-checked before it lands,
|
|
# and the whole sudoers tree is checked after, so a bad edit can never lock infra-ops out.
|
|
steps:
|
|
- name: add the BULK_DATA exemption to /etc/sudoers.d/infra-ops (visudo-checked before install)
|
|
sudo: true
|
|
shell: |
|
|
set -e
|
|
cp /etc/sudoers.d/infra-ops /etc/sudoers.d/.infra-ops.new
|
|
cat >> /etc/sudoers.d/.infra-ops.new <<'EOF'
|
|
# Bulk data movers: keep the audit line, do not record the bytes (eshpfi playbooks/sudoers-infra-ops-bulk-no-log-output.yaml)
|
|
Cmnd_Alias BULK_DATA = /usr/bin/rsync, /usr/bin/tar, /usr/bin/cat, /usr/bin/dd, /usr/bin/zstd, /usr/bin/zcat, /usr/bin/gzip, /usr/bin/pv, /usr/bin/docker save *, /usr/bin/docker export *, /usr/bin/docker cp *
|
|
Defaults!BULK_DATA !log_output
|
|
EOF
|
|
chmod 440 /etc/sudoers.d/.infra-ops.new
|
|
if visudo -cf /etc/sudoers.d/.infra-ops.new >/dev/null; then
|
|
mv /etc/sudoers.d/.infra-ops.new /etc/sudoers.d/infra-ops
|
|
else
|
|
rm -f /etc/sudoers.d/.infra-ops.new; echo "VISUDO REJECTED THE NEW FILE"; exit 1
|
|
fi
|
|
visudo -c >/dev/null
|
|
cat /etc/sudoers.d/infra-ops
|
|
when: "grep -q log_output /etc/sudoers.d/infra-ops && ! grep -q BULK_DATA /etc/sudoers.d/infra-ops"
|
|
|
|
verify:
|
|
- name: whole sudoers tree parses, and infra-ops still has NOPASSWD sudo
|
|
sudo: true
|
|
shell: visudo -c >/dev/null && sudo -n -u infra-ops sudo -n true
|
|
changed_when: "false"
|
|
- name: positive + negative control — `sudo id` still records a session, `sudo tar --version` no longer does
|
|
sudo: true
|
|
shell: |
|
|
set -e
|
|
[ -d /var/log/sudo-io ] || { echo "no sudo-io on this host"; exit 0; }
|
|
n() { find /var/log/sudo-io -mindepth 3 -maxdepth 3 -type d | wc -l; }
|
|
a=$(n); sudo -n -u infra-ops sudo -n /usr/bin/tar --version >/dev/null; b=$(n)
|
|
sudo -n -u infra-ops sudo -n id >/dev/null; c=$(n)
|
|
echo "sessions: start $a, after tar $b, after id $c"
|
|
test "$b" -eq "$a"
|
|
test "$c" -gt "$b"
|
|
changed_when: "false"
|