BNF diagram for sudo file

Question

How can I generate a (BNF) railroad diagram for /etc/sudoers file?

I know the sudoers manpage has Extended Backus-Naur Form informations. Also, there are some tools to generate such diagrams (see Tool for generating railroad diagram used on json.org )

score 0 · Answer 1 · answered Jun 02 '15 at 11:50

You have to grab each part of the BNF schema from the sudo manpage, then copy-paste in your favorite tool (Railroad (online) diagram generator or dokuwiki EBNF plugin).

Make sure you get all the snippets to have a valid schema (!). Also, there are some common issues...

+netgroup must be replaced by '+' netgroup (because + is a suffix for items repeating 1 or more times in some BNF variants).

Trailing backslash (\) should be removed.

/netmask should be replaced with '/'netmask (because elements separated by slash ("/") are alternatives in some BNF variants).

Here's RHEL/CEntOS 7 EBNF after those cleanup (plus some minor ones), which you can paste in http://bottlecaps.de/rr/ui (paste in tab "Edit Grammar", then click on tab "View Diagram"). code license:


Alias ::= 'User_Alias'  User_Alias (':' User_Alias)* |
          'Runas_Alias' Runas_Alias (':' Runas_Alias)* |
          'Host_Alias'  Host_Alias (':' Host_Alias)* |
          'Cmnd_Alias'  Cmnd_Alias (':' Cmnd_Alias)*

User_Alias ::= NAME '=' User_List

Runas_Alias ::= NAME '=' Runas_List

Host_Alias ::= NAME '=' Host_List

Cmnd_Alias ::= NAME '=' Cmnd_List

NAME ::= [A-Z]([A-Z][0-9]_)*

User_List ::= User |
              User ',' User_List

User ::= '!'* user name |
         '!'* '#' uid |
         '!'* '%' group |
         '!'* '%#' gid |
         '!'* '+' netgroup |
         '!'* '%:' nonunix_group |
         '!'* '%:#' nonunix_gid |
         '!'* User_Alias

Runas_List ::= Runas_Member |
               Runas_Member ',' Runas_List

Runas_Member ::= '!'* user name |
                 '!'* '#' uid |
                 '!'* '%' group |
                 '!'* '%#' gid |
                 '!'* '%:' nonunix_group |
                 '!'* '%:#' nonunix_gid |
                 '!'* '+' netgroup |
                 '!'* Runas_Alias

Host_List ::= Host |
              Host ',' Host_List

Host ::= '!'* host name |
         '!'* ip_addr |
         '!'* network('/'netmask)? |
         '!'* '+' netgroup |
         '!'* Host_Alias

Cmnd_List ::= Cmnd |
              Cmnd ',' Cmnd_List

command name ::= file name |
                 file name args |
                 file name '""'

Cmnd ::= '!'* command name |
         '!'* directory |
         '!'* "sudoedit" |
         '!'* Cmnd_Alias

Default_Type ::= 'Defaults' |
                 'Defaults' '@' Host_List |
                 'Defaults' ':' User_List |
                 'Defaults' '!' Cmnd_List |
                 'Defaults' '>' Runas_List

Default_Entry ::= Default_Type Parameter_List

Parameter_List ::= Parameter |
                   Parameter ',' Parameter_List

Parameter ::= Parameter '=' Value |
              Parameter '+=' Value |
              Parameter '-=' Value |
              '!'* Parameter

User_Spec ::= User_List Host_List '=' Cmnd_Spec_List 
              (':' Host_List '=' Cmnd_Spec_List)*

Cmnd_Spec_List ::= Cmnd_Spec |
                   Cmnd_Spec ',' Cmnd_Spec_List

Cmnd_Spec ::= Runas_Spec? SELinux_Spec? Tag_Spec* Cmnd

Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')'

SELinux_Spec ::= ('ROLE=role' | 'TYPE=type')

Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
              'SETENV:' | 'NOSETENV:' | 'LOG_INPUT:' | 'NOLOG_INPUT:' |
              'LOG_OUTPUT:' | 'NOLOG_OUTPUT:')

BNF diagram for sudo file

1 Answers1