11 lines
621 B
Plaintext
11 lines
621 B
Plaintext
# Install with: sudo visudo -cf backend/deploy/audit-deploy-sudoers && \
|
|
# sudo cp backend/deploy/audit-deploy-sudoers /etc/sudoers.d/audit-deploy
|
|
#
|
|
# Grants the unprivileged `auditapi` user exactly two commands, nothing else:
|
|
# restarting the audit-endpoint unit (from deploy.sh) and its own webhook
|
|
# unit (for the rare manual restart noted in deploy.sh). No shell, no wildcard
|
|
# arguments, no other systemctl verb - "restart" only, these two unit names
|
|
# only.
|
|
auditapi ALL=(root) NOPASSWD: /usr/bin/systemctl restart audit-endpoint
|
|
auditapi ALL=(root) NOPASSWD: /usr/bin/systemctl restart audit-webhook
|