30.4. Adding sudo Commands, Command Groups, and Rules 30.4.1. Adding sudo Commands Adding sudo Commands in the Web UI Under the Policy tab, click Sudo Sudo Commands . Click Add at the top of the list. Fill out the information about the command. Enter the full system path to the command executable. Figure 30.1. Adding a New sudo Command Click Add . Alternatively, click Add and Add Another to start adding another entry or Add and Edit to start editing the new entry. Adding sudo Commands from the Command Line To add a sudo command, use the ipa sudocmd-add command. Provide the full system path to the command executable. For example, to add the /usr/bin/less command and a description: 30.4.2. Adding sudo Command Groups Adding sudo Command Groups in the Web UI Under the Policy tab, click Sudo Sudo Command Groups . Click Add at the top of the list. Fill out the information about the command group. Figure 30.2. Adding a New sudo Command Group Click Add and Edit to start editing the command group. Under the Sudo Commands tab, click Add to add a sudo command to the group. Select the required commands and move them to the Prospective column using the > button. Figure 30.3. Adding Commands to a sudo Command Group Click Add . Adding sudo Command Groups from the Command Line Create the command group using the ipa sudocmdgroup-add command. For example, to create the files command group and add its description: Include a sudo command in the group using the ipa sudocmdgroup-add-member command. Note that you can only include commands that have already been added to IdM, as described in Section 30.4.1, "Adding sudo Commands" . 30.4.3. Adding sudo Rules Adding sudo Rules in the Web UI Under the Policy tab, click Sudo Sudo Rules . Click Add at the top of the list. Enter the name for the rule. Figure 30.4. Naming a New sudo Rule Click Add . Alternatively, click Add and Add Another to start adding another entry or Add and Edit to start editing the new entry. For information on how to edit the new sudo rule, see Section 30.6, "Modifying sudo Rules" . Adding sudo Rules from the Command Line To add a new sudo rule, use the ipa sudorule-add command. For example, to add a rule named files-commands : For more information on using ipa sudorule-add and the options it accepts, run the command with the --help option added. For information on how to edit the new sudo rule, see Section 30.6, "Modifying sudo Rules" . For a complete example of adding a new sudo rule and editing it from the command line, see Example 30.1, "Adding and Modifying a New sudo Rule from the Command Line" .

Commands:
ipa sudocmd-add /usr/bin/less --desc="For reading log files" ---------------------------------- Added sudo command "/usr/bin/less" ---------------------------------- sudo Command: /usr/bin/less Description: For reading log files
ipa sudocmdgroup-add files --desc="File editing commands" ----------------------------------- Added sudo command group "files" ----------------------------------- sudo Command Group: files Description: File editing commands
ipa sudocmdgroup-add-member files --sudocmds "/usr/bin/vim" sudo Command Group: files Description: File editing commands Member sudo commands: /usr/bin/vim ------------------------- Number of members added 1 -------------------------
ipa sudorule-add files-commands -------------------------------- Added Sudo Rule "files-commands" -------------------------------- Rule name: files-commands Enabled: TRUE