arch-setup-sudo

#!/bin/sh
#
# Configure sudo.
#
# Add standard administrator's group 'wheel' into sudoers.
# If variable ARCH_SETUP_SUDO_NOPASSWD is defined and non-empty, then sudo are
# allowed without a password.
#
# The default /etc/sudoers typically ends with something like this:
#
#   ##
#   ## User privilege specification
#   ##
#   root ALL=(ALL:ALL) ALL
#
#   ## Uncomment to allow members of group wheel to execute any command
#   # %wheel ALL=(ALL:ALL) ALL
#
#   ## Same thing without a password
#   # %wheel ALL=(ALL:ALL) NOPASSWD: ALL
#
#   ## Uncomment to allow members of group sudo to execute any command
#   # %sudo ALL=(ALL:ALL) ALL
#
#   ## Uncomment to allow any user to run sudo if they know the password
#   ## of the user they are running the command as (root by default).
#   # Defaults targetpw  # Ask for the password of the target user
#   # ALL ALL=(ALL:ALL) ALL  # WARNING: only use this together with 'Defaults targetpw'
#
#   ## Read drop-in files from /etc/sudoers.d
#   @includedir /etc/sudoers.d
#
# Older versions used "ALL=(ALL) ALL" syntax instead of "ALL=(ALL:ALL) ALL", which
# allowed sudo as any user but only the primary group (normally root).
# For completeness newer versions include reference to both groups wheel
# and sudo, but wheel is the traditional group that re used by Arch (sudo
# was introduced by Debian and also used on Ubuntu).
#
# Here we just look for an uncommented line referring to the %wheel group,
# and assume then it is already configured without further considerations.
# If not found we create a new file /etc/sudoers.d/wheel and write the
# corresponding line in there. Hard to make this very robust, with regards
# to possible file edits, additional files in sudoers.d etc. 
#

# Verify running as root (not relying on sudo which may not be installed yet).
if [ ${EUID:-$(id -u)} -ne 0 ]; then
    echo 'Please run this script as root' >&2
    exit 1
fi

# Check if sudoers file seems to have configured wheel group, if not then
# add configuration in separate config file /etc/sudoers.d/wheel, unless it already exists.
if grep --quiet --extended-regexp '^\s*%wheel\s+' /etc/sudoers; then # Any configuration of the wheel group uncommented in main config file?
    echo "Skipping sudoers update: Group wheel is already configured"
    grep --extended-regexp '^(\s|#)*%wheel\s+' /etc/sudoers # Show all, commented or not!
elif [ -f "/etc/sudoers.d/wheel" ]; then
    echo "Skipping sudoers update: File /etc/sudoers.d/wheel already exists"
    cat /etc/sudoers.d/wheel
elif [ -z "$ARCH_SETUP_SUDO_NOPASSWD" ]; then
    echo "Creating /etc/sudoers.d/wheel adding group wheel to sudoers"
    (umask 0337 && echo "%wheel ALL=(ALL:ALL) ALL" | tee /etc/sudoers.d/wheel)
else
    echo "Creating /etc/sudoers.d/wheel adding group wheel without requiring password to sudoers"
    (umask 0337 && echo "%wheel ALL=(ALL:ALL) NOPASSWD: ALL" | tee /etc/sudoers.d/wheel)
fi