mitchellh/vagrant — pull request #3638 by jtopper (2014-05-05 23:08:17+00:00)
Title: Improve use of sudo for NFS export manipulation

Some users (myself and the denizens of #2642 included) want to allow Vagrant to manipulate NFS configs without requesting a sudo password each time.

The current approach, using "sudo -s" requires that we permit the whole shell to be run passwordless in sudoers, and that's rather too open to be safe.

This patch uses an alternative idiom, using 'tee' instead of output redirection to append to the exports file. On application of this patch, the following sudoers config (on OSX, at least), permits fully passwordless operation in a much safer manner:

```
Cmnd_Alias VAGRANT_EXPORTS_ADD = /usr/bin/tee -a /etc/exports
Cmnd_Alias VAGRANT_NFSD = /sbin/nfsd restart
Cmnd_Alias VAGRANT_EXPORTS_REMOVE = /usr/bin/sed -E -e /*/ d -ibak /etc/exports
%admin ALL=(root) NOPASSWD: VAGRANT_EXPORTS_ADD, VAGRANT_NFSD, VAGRANT_EXPORTS_REMOVE
```

This feels like a good interim step if work on the suid helper has paused for now.

NB: I've been unable to test the patch to the Linux plugin at this time.