Mdthbs

I was reading through the sudoers policy manual. Under 'User specification' section, I saw Date_Spec as part of the Option_Spec, in turn an optional part of the Cmnd_Spec.

 User_Spec ::= User_List Host_List '=' Cmnd_Spec_List 

               (':' Host_List '=' Cmnd_Spec_List)*



 Cmnd_Spec_List ::= Cmnd_Spec |

                    Cmnd_Spec ',' Cmnd_Spec_List



 Cmnd_Spec ::= Runas_Spec? Option_Spec* Tag_Spec* Cmnd



 Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')'



 Option_Spec ::= (Date_Spec | Timeout_Spec)



 Date_Spec ::= ('NOTBEFORE=timestamp' | 'NOTAFTER=timestamp')



 Timeout_Spec ::= 'TIMEOUT=timeout'

What does this do? From my reading, it looks like something I can use to restrict the time span within which a user can run a command. Is that correct? If so, what are the possible use cases for such a feature?

Ref: man 5 sudoers

Support for the Date_Spec appears to have been added in version 1.8.20, with the Changelog indicating that it the code was changed by 2017-02-18:

Add NOTBEFORE and NOTAFTER command options similar to what is already available in LDAP.

The option does exactly as you guessed: restricts the corresponding rule to have a start and/or end date.

For example, I added this rule:

jeff2 ALL=(ALL) NOTBEFORE=20190409212700 /bin/ps

and then executed the following as jeff2:

$ sudo -l

# ... elided ...

User jeff2 may run the following commands on r2d2:

    (ALL) /bin/ls

    (ALL) NOTBEFORE=20190410012700Z /bin/ps

$ date -u '+%Y%m%d %H:%M:%S'

20190410 01:25:52

$ sudo /bin/ps

Sorry, user jeff2 is not allowed to execute '/bin/ps' as root on r2d2.

$ sleep 2m   ## plus get distracted by something

$ date -u '+%Y%m%d %H:%M:%S'

20190410 01:29:33

$ sudo /bin/ps

  PID TTY          TIME CMD

 9607 pts/1    00:00:00 ps

I can see a use-case for this where you want to grant temporary additional access (say for a specific application upgrade or change), but you don't want to have to remember to log in before and after that timeframe to update sudoers. Perhaps you have a privileged user that's changing roles and no longer needs certain commands after a certain date; you could use NOTAFTER at your convenience, then go in later and delete the rules at some point later. Similarly with NOTBEFORE for someone changing roles into one that is a more privileged.