Change 196425 had a related patch set uploaded (by Dzahn):
create a phab-roots admin group, add demon

https://gerrit.wikimedia.org/r/196425

give me a day or so to poke at this and make sure the perms and abilities are sane (i.e. you can do things). We haven't piecemealed it out before so it's new territory.

first we should create a new admin group for this, either phab-roots , that would assume it's a request for sudo ALL ALL, or phab-admins, that would mean to me that we can list the needed commands and limit sudo to the ones needed.

I want to have a meme I can use to indicate my manager approval.

Approve.

http://knowyourmeme.com/memes/approval-guy

What are you approving though? :)

In T92564#1114939, @Dzahn wrote:

What are you approving though? :)

Whatever access chad needs to manage repos in Phab.

In T92564#1115364, @RobH wrote:

Additionally, as this is requesting sudo, it will need to be an agenda item in our monday operations meeting.

only if it is really requesting sudo as in full root / ALL ALL, not if we actually list just a couple needed commands to be allowed, if i'm not mistaken about the policy

Policy states https://wikitech.wikimedia.org/wiki/Requesting_shell_access:

5. If your access request includes any level of sudo privileges on a system, your request will have a 'mandatory' security review in the weekly operations meetings. Sudo access is granted on an extremely limited basis, and will typically apply to the smallest permissions possible (user/process restricted over all). Expect this process to take at least one business week.

As such, this is sudo. I wrote this part of the policy initially, and I meant it to be for all scopes of sudo (outside of those who have deployers) for any kind of actions (other than info pull by non-root-sudo use). I'm open to this being changed, but then we need to also review that in the ops meeting =]

gotcha, then to the meeting Etherpad it goes

In T92564#1115364, @RobH wrote:

@demon: please sign https://phabricator.wikimedia.org/L3

Signed.

Oh man, now I'm responsible for my behavior? :p

https://gerrit.wikimedia.org/r/#/c/196613/

Change 196425 abandoned by Dzahn:
create a phab-roots admin group, add demon

https://gerrit.wikimedia.org/r/196425

The sudo review for this passed ops meeting review. We should continue to narrow the scope of the sudo rights on this host as needed, but overall approval is granted.

https://gerrit.wikimedia.org/r/#/c/196613/ has been merged and narrows the rights down to:

/srv/phab/phabricator/bin/phd
/srv/phab/phabricator/bin/worker
/srv/phab/phabricator/bin/repository
/srv/phab/phabricator/bin/remove destroy