{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/os/issues/96","repository_url":"https://api.github.com/repos/openshift/os","labels_url":"https://api.github.com/repos/openshift/os/issues/96/labels{/name}","comments_url":"https://api.github.com/repos/openshift/os/issues/96/comments","events_url":"https://api.github.com/repos/openshift/os/issues/96/events","html_url":"https://github.com/openshift/os/issues/96","id":331290400,"node_id":"MDU6SXNzdWUzMzEyOTA0MDA=","number":96,"title":"No sudoers groups exist with NOPASSWD","user":{"login":"arithx","id":1923653,"node_id":"MDQ6VXNlcjE5MjM2NTM=","avatar_url":"https://avatars1.githubusercontent.com/u/1923653?v=4","gravatar_id":"","url":"https://api.github.com/users/arithx","html_url":"https://github.com/arithx","followers_url":"https://api.github.com/users/arithx/followers","following_url":"https://api.github.com/users/arithx/following{/other_user}","gists_url":"https://api.github.com/users/arithx/gists{/gist_id}","starred_url":"https://api.github.com/users/arithx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arithx/subscriptions","organizations_url":"https://api.github.com/users/arithx/orgs","repos_url":"https://api.github.com/users/arithx/repos","events_url":"https://api.github.com/users/arithx/events{/privacy}","received_events_url":"https://api.github.com/users/arithx/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-06-11T18:00:21Z","updated_at":"2018-06-13T21:38:12Z","closed_at":null,"author_association":"NONE","body":"By default it doesn't seem like any groups exist in `/etc/sudoers`. On Container Linux both the `%sudo` group & the `core` user have `NOPASSWD`. \r\n\r\nThe default `sudoers` for CL (from `/usr/share/baselayout/sudoers`):\r\n```\r\n## Default sudoers for CoreOS\r\n\r\n## Pass LESSCHARSET through for systemd commands run through sudo that call less.\r\n## See https://github.com/coreos/bugs/issues/365.\r\nDefaults env_keep += \"LESSCHARSET\"\r\n\r\n## enable root and wheel\r\nroot ALL=(ALL) ALL\r\n%wheel ALL=(ALL) ALL\r\n\r\n## enable passwordless access for sudo\r\n%sudo ALL=(ALL) NOPASSWD: ALL\r\n\r\n## the core user has no password by default\r\ncore ALL=(ALL) NOPASSWD: ALL\r\n\r\n## Read drop-in files from /etc/sudoers.d\r\n## (the '#' here does not indicate a comment)\r\n#includedir /etc/sudoers.d\r\n```"},"comment":{"url":"https://api.github.com/repos/openshift/os/issues/comments/397096087","html_url":"https://github.com/openshift/os/issues/96#issuecomment-397096087","issue_url":"https://api.github.com/repos/openshift/os/issues/96","id":397096087,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NzA5NjA4Nw==","user":{"login":"cgwalters","id":244096,"node_id":"MDQ6VXNlcjI0NDA5Ng==","avatar_url":"https://avatars0.githubusercontent.com/u/244096?v=4","gravatar_id":"","url":"https://api.github.com/users/cgwalters","html_url":"https://github.com/cgwalters","followers_url":"https://api.github.com/users/cgwalters/followers","following_url":"https://api.github.com/users/cgwalters/following{/other_user}","gists_url":"https://api.github.com/users/cgwalters/gists{/gist_id}","starred_url":"https://api.github.com/users/cgwalters/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cgwalters/subscriptions","organizations_url":"https://api.github.com/users/cgwalters/orgs","repos_url":"https://api.github.com/users/cgwalters/repos","events_url":"https://api.github.com/users/cgwalters/events{/privacy}","received_events_url":"https://api.github.com/users/cgwalters/received_events","type":"User","site_admin":false},"created_at":"2018-06-13T21:38:12Z","updated_at":"2018-06-13T21:38:12Z","author_association":"CONTRIBUTOR","body":"Strawman: something like:\r\n\r\n```\r\ndiff --git a/dracut/30ignition/ignition-quench.clc b/dracut/30ignition/ignition-quench.clc\r\nindex 7fd4e82..ed57380 100644\r\n--- a/dracut/30ignition/ignition-quench.clc\r\n+++ b/dracut/30ignition/ignition-quench.clc\r\n@@ -1,11 +1,15 @@\r\n-# This file contains the source for ignition-quench.ign. This file becomes the\r\n-# base system Ignition config, which makes Ignition install a oneshot systemd\r\n-# unit that only runs on first boot to remove `coreos.first_boot` from the\r\n-# kernel command line in /boot/grub2/grub.cfg.\r\n+# This file contains the source for the base system Ignition config.  It\r\n+# does a few things such as adding the `core` user if no users were specified,\r\n+# and also adds oneshot systemd unit to mark the system as having been booted.\r\n #\r\n # Can be regenerated with:\r\n #\r\n #     ct <ignition-quench.clc --pretty >ignition-quench.ign\r\n+passwd:\r\n+  users:\r\n+    - name: core\r\n+      groups:\r\n+        - wheel\r\n systemd:\r\n   units:\r\n     - name: ignition-quench.service\r\n```\r\n\r\nplus changing our default sudo config to `%wheel ALL=(ALL) NOPASSWD: ALL`  ?"}}
{"actor":{"display_login":"cgwalters"}}