# Example sudoers file to use for the unprivileged qbee-agent user, but allow certain
# operations with sudo access

# Package management
Cmnd_Alias YUM_CMDS = /usr/bin/yum, /bin/yum, /usr/bin/dnf, /bin/dnf
Cmnd_Alias RPM_CMDS = /usr/bin/rpm, /bin/rpm
Cmnd_Alias DPKG_CMDS = /usr/bin/dpkg, /bin/dpkg
Cmnd_Alias APT_GET_CMDS = /usr/bin/apt-get, /bin/apt-get
Defaults!APT_GET_CMDS env_keep+=DEBIAN_FRONTEND
Cmnd_Alias OPKG_CMDS = /bin/opkg
Cmnd_Alias PKG_CMDS = APT_GET_CMDS, YUM_CMDS, RPM_CMDS, DPKG_CMDS, OPKG_CMDS
Cmnd_Alias SYSTEMCTL_CMDS = /bin/systemctl, /usr/bin/systemctl
Cmnd_Alias SERVICE_CMDS = SYSTEMCTL_CMDS

# Firewall management
Cmnd_Alias FIREWALL_CMDS = /usr/sbin/iptables, /sbin/iptables

# A/B updates (rauc) and connectivity watchdog
Cmnd_Alias SHUTDOWN_CMDS = /usr/sbin/shutdown, /sbin/shutdown

# A/B updates (rauc)
Cmnd_Alias OTA_CMDS = /usr/bin/rauc

# User management
Cmnd_Alias USER_CMDS = /usr/sbin/useradd, /sbin/useradd, /usr/sbin/userdel, /sbin/userdel

# Suppress logging of sudo executions for user
Defaults:qbee-agent !syslog, env_keep+="HTTP_PROXY HTTPS_PROXY http_proxy https_proxy NO_PROXY no_proxy"

qbee-agent ALL=(ALL) NOPASSWD: SHUTDOWN_CMDS, OTA_CMDS, PKG_CMDS, FIREWALL_CMDS, USER_CMDS, SERVICE_CMDS
