puppet-sudo icon indicating copy to clipboard operation
puppet-sudo copied to clipboard

Support modifying sudoers Defaults

Open deric opened this issue 2 years ago • 5 comments

This PR introduces a possibility to modify sudoers defaults without the need to provide whole configuration file.

However, it would be only possible to add new entries:

sudo::defaults:
  mailto: 
    value: 'root'

would be converted to a line in /etc/sudoers

Defaults mailto=root

The sudoers syntax is fairly complex:

     Default_Type ::= 'Defaults' |
                      'Defaults' '@' Host_List |
                      'Defaults' ':' User_List |
                      'Defaults' '!' Cmnd_List |
                      'Defaults' '>' Runas_List

     Default_Entry ::= Default_Type Parameter_List

     Parameter_List ::= Parameter |
                        Parameter ',' Parameter_List

     Parameter ::= Parameter '=' Value |
                   Parameter '+=' Value |
                   Parameter '-=' Value |
                   '!'* Parameter

There's a possibility to add more complex configurations:

sudo::defaults:
  mailto:
    type: '@hosts_list'
    operator: '+='
    value: [email protected]

deric avatar Jun 29 '22 15:06 deric

What a great idea. You just saved me a lot of time, too in implementing this. I'm going to play with your changes today.

bschonec avatar Jul 12 '22 18:07 bschonec

Ruby 2.5 is EOL, probably could be updated to Ruby 2.6, right?

Ruby 2.5 status: eol release date: 2017-12-25 EOL date: 2021-04-05

deric avatar Jul 13 '22 13:07 deric

@deric Would you be so kind as to slipstream my updates to your fork and resubmit this pull request?

bschonec avatar Jul 13 '22 18:07 bschonec

@deric LGTM but I'd prefer, to have separate PRs for using hiera and the defaults part. Easier to spot any issues in each part.

saz avatar Jul 17 '22 20:07 saz

@bschonec I've added your RHEL7 template modifications. @saz I understand the PR is modifying too many files. I've added a common Ruby function that formats the defaults config. Thus each OS template requires only single line change.

deric avatar Jul 18 '22 10:07 deric