Skip to content

Commit 2accc9b

Browse files
patemerypatemery
committed
Merge branch 'master' into enhanced-epp-support
2 parents c90fb87 + b6f6cbc commit 2accc9b

27 files changed

+481
-70
lines changed

‎README.md

+18-50
Original file line numberDiff line numberDiff line change
@@ -39,31 +39,6 @@ If this is not what you're expecting, set `purge` and/or `config_file_replace` t
3939
}
4040
```
4141

42-
#### Selective Purge of sudoers.d Directory
43-
A combination of `prefix`, `suffix` and `purge_ignore` can be used to purge only files that puppet previously created.
44-
If `suffix` is specified all puppet created sudoers.d entries will have this suffix apprended to
45-
the thier file name. If `prefix` is specified all puppet created sudoers.d entries will have this prefix
46-
prepended. A ruby glob can be used as `ignore` to ignore all files that do not have
47-
this suffix.
48-
49-
```puppet
50-
class{'sudo':
51-
suffix => '_puppet',
52-
purge_ignore => '*[!_puppet]',
53-
}
54-
```
55-
56-
or
57-
58-
```puppet
59-
class{'sudo':
60-
prefix => 'puppet_',
61-
purge_ignore => '[!puppet_]*',
62-
}
63-
```
64-
65-
Due to limitations in ruby glob the prefix and ignore is recommended.
66-
6742
#### Leave current sudo config as it is
6843
```puppet
6944
class { 'sudo':
@@ -231,6 +206,22 @@ sudo::configs:
231206
- 'ALL'
232207
'commands':
233208
- 'ALL'
209+
210+
##### Override sudoers defaults
211+
212+
You can modify `Default_Entry` lines by passing a `Hash` to `sudo::defaults`, where the key is `Defaults` parameter name (see `man 5 sudoers` for more details):
213+
214+
```yaml
215+
sudo::defaults:
216+
lecture:
217+
value: always
218+
badpass_message:
219+
value: "Password is wrong, please try again"
220+
passwd_tries:
221+
value: 5
222+
insults:
223+
mailto:
224+
value: [email protected]
234225
```
235226

236227
##### Set a custom name for the sudoers file
@@ -252,31 +243,8 @@ sudo::conf { "foreman-proxy":
252243

253244
## sudo class parameters
254245

255-
| Parameter | Type | Default | Description |
256-
| :-------------- | :------ |:----------- | :---------- |
257-
| enable | boolean | true | Set this to remove or purge all sudoers configs |
258-
| package | string | OS specific | Set package name _(for unsupported platforms)_ |
259-
| package_ensure | string | present | latest, absent, or a specific package version |
260-
| package_source | string | OS specific | Set package source _(for unsupported platforms)_ |
261-
| purge | boolean | true | Purge unmanaged files from config_dir |
262-
| purge_ignore | string | undef | Files excluded from purging in config_dir |
263-
| config_file | string | OS specific | Set config_file _(for unsupported platforms)_ |
264-
| config_file_replace | boolean | true | Replace config file with module config file |
265-
| includedirsudoers | boolean | OS specific | Add #includedir /etc/sudoers.d with augeas |
266-
| config_dir | string | OS specific | Set config_dir _(for unsupported platforms)_ |
267-
| content | string | OS specific | Alternate content file location |
268-
| ldap_enable | boolean | false | Add support to LDAP |
269-
| configs | hash | {} | A hash of sudo::conf's |
246+
See REFERENCE.md
270247

271248
## sudo::conf class / sudo::configs hash parameters
272249

273-
| Parameter | Type | Default | Description |
274-
| :-------------- | :----- |:----------- | :---------- |
275-
| ensure | string | present | present or absent |
276-
| priority | number | 10 | file name prefix |
277-
| content | string | undef | content of configuration snippet |
278-
| source | string | undef | source of configuration snippet |
279-
| template | string | undef | template of configuration snippet |
280-
| template_epp | hash | undef | template and parameters for an epp configuration snippet |
281-
| sudo_config_dir | string | OS Specific | configuration snippet directory _(for unsupported platforms)_ |
282-
| sudo_file_name | string | undef | custom file name for sudo file in sudoers directory |
250+
See REFERENCE.md

‎REFERENCE.md

+109
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,15 @@ rpm. so we add a dependencies to the ldap module.
2323

2424
* [`sudo::conf`](#sudo--conf): Manages sudo configuration snippets
2525

26+
### Functions
27+
28+
* [`sudo::defaults`](#sudo--defaults): Formats sudoers defaults config see https://linux.die.net/man/5/sudoers Default_Type ::= 'Defaults' | 'Defaults' '@
29+
30+
### Data types
31+
32+
* [`Sudo::Defaults`](#Sudo--Defaults): sudo defaults
33+
* [`Sudo::Defaults_operator`](#Sudo--Defaults_operator): custom datatype that validates sudo defaults operators
34+
2635
## Classes
2736

2837
### <a name="sudo"></a>`sudo`
@@ -43,6 +52,7 @@ The following parameters are available in the `sudo` class:
4352

4453
* [`enable`](#-sudo--enable)
4554
* [`package`](#-sudo--package)
55+
* [`package_manage`](#-sudo--package_manage)
4656
* [`package_ldap`](#-sudo--package_ldap)
4757
* [`package_ensure`](#-sudo--package_ensure)
4858
* [`package_source`](#-sudo--package_source)
@@ -70,6 +80,7 @@ The following parameters are available in the `sudo` class:
7080
* [`wheel_config`](#-sudo--wheel_config)
7181
* [`sudoreplay_discard`](#-sudo--sudoreplay_discard)
7282
* [`configs`](#-sudo--configs)
83+
* [`defaults`](#-sudo--defaults)
7384

7485
##### <a name="-sudo--enable"></a>`enable`
7586

@@ -89,6 +100,14 @@ what you're doing.
89100

90101
Default value: `$sudo::params::package`
91102

103+
##### <a name="-sudo--package_manage"></a>`package_manage`
104+
105+
Data type: `Boolean`
106+
107+
Whether or not to manage the sudo package.
108+
109+
Default value: `true`
110+
92111
##### <a name="-sudo--package_ldap"></a>`package_ldap`
93112

94113
Data type: `Optional[String[1]]`
@@ -326,6 +345,14 @@ A hash of sudo::conf's
326345

327346
Default value: `{}`
328347

348+
##### <a name="-sudo--defaults"></a>`defaults`
349+
350+
Data type: `Sudo::Defaults`
351+
352+
353+
354+
Default value: `$sudo::params::defaults`
355+
329356
### <a name="sudo--allow"></a>`sudo::allow`
330357

331358
This class allows you to take complete advantage of automatic parameter
@@ -497,3 +524,85 @@ Path to use for executing the sudo syntax check
497524

498525
Default value: `'/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'`
499526

527+
## Functions
528+
529+
### <a name="sudo--defaults"></a>`sudo::defaults`
530+
531+
Type: Ruby 4.x API
532+
533+
Formats sudoers defaults config see https://linux.die.net/man/5/sudoers
534+
535+
Default_Type ::= 'Defaults' |
536+
'Defaults' '@' Host_List |
537+
'Defaults' ':' User_List |
538+
'Defaults' '!' Cmnd_List |
539+
'Defaults' '>' Runas_List
540+
541+
Default_Entry ::= Default_Type Parameter_List
542+
543+
Parameter_List ::= Parameter |
544+
Parameter ',' Parameter_List
545+
546+
Parameter ::= Parameter '=' Value |
547+
Parameter '+=' Value |
548+
Parameter '-=' Value |
549+
'!'* Parameter
550+
551+
The function is passed an Array of Tuples
552+
e.g. [["env_reset", nil]]
553+
[["mailto", {"value" => root}]]
554+
555+
#### `sudo::defaults(Any *$args)`
556+
557+
Formats sudoers defaults config see https://linux.die.net/man/5/sudoers
558+
559+
Default_Type ::= 'Defaults' |
560+
'Defaults' '@' Host_List |
561+
'Defaults' ':' User_List |
562+
'Defaults' '!' Cmnd_List |
563+
'Defaults' '>' Runas_List
564+
565+
Default_Entry ::= Default_Type Parameter_List
566+
567+
Parameter_List ::= Parameter |
568+
Parameter ',' Parameter_List
569+
570+
Parameter ::= Parameter '=' Value |
571+
Parameter '+=' Value |
572+
Parameter '-=' Value |
573+
'!'* Parameter
574+
575+
The function is passed an Array of Tuples
576+
e.g. [["env_reset", nil]]
577+
[["mailto", {"value" => root}]]
578+
579+
Returns: `String`
580+
581+
##### `*args`
582+
583+
Data type: `Any`
584+
585+
586+
587+
## Data types
588+
589+
### <a name="Sudo--Defaults"></a>`Sudo::Defaults`
590+
591+
sudo defaults
592+
593+
Alias of
594+
595+
```puppet
596+
Hash[String, Variant[Struct[{
597+
Optional[list] => String,
598+
Optional[operator] => Sudo::Defaults_operator,
599+
Optional[value] => Variant[String,Numeric],
600+
}], Undef]]
601+
```
602+
603+
### <a name="Sudo--Defaults_operator"></a>`Sudo::Defaults_operator`
604+
605+
custom datatype that validates sudo defaults operators
606+
607+
Alias of `Enum['=', '+=', '-=', '!']`
608+

‎lib/puppet/functions/sudo/defaults.rb

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# frozen_string_literal: false
2+
3+
# Formats sudoers defaults config see https://linux.die.net/man/5/sudoers
4+
#
5+
# Default_Type ::= 'Defaults' |
6+
# 'Defaults' '@' Host_List |
7+
# 'Defaults' ':' User_List |
8+
# 'Defaults' '!' Cmnd_List |
9+
# 'Defaults' '>' Runas_List
10+
#
11+
# Default_Entry ::= Default_Type Parameter_List
12+
#
13+
# Parameter_List ::= Parameter |
14+
# Parameter ',' Parameter_List
15+
#
16+
# Parameter ::= Parameter '=' Value |
17+
# Parameter '+=' Value |
18+
# Parameter '-=' Value |
19+
# '!'* Parameter
20+
#
21+
# The function is passed an Array of Tuples
22+
# e.g. [["env_reset", nil]]
23+
# [["mailto", {"value" => root}]]
24+
Puppet::Functions.create_function(:'sudo::defaults') do
25+
dispatch :defaults do
26+
repeated_param 'Any', :args
27+
return_type 'String'
28+
end
29+
30+
def defaults(*args)
31+
res = ''
32+
raise "Unsupported number of arguments #{args.size}: #{args.inspect}" if args.nil?
33+
34+
args.each do |tuple|
35+
raise "Unsupported number of arguments #{args.size}: #{args.inspect}" unless tuple.size == 2
36+
37+
res.concat(defaults_entry(tuple[0], tuple[1]))
38+
end
39+
40+
res
41+
end
42+
43+
def defaults_entry(key, config)
44+
entry = "Defaults\t#{key}"
45+
46+
unless config.nil?
47+
entry.concat((config['list']).to_s) if config.key? 'list'
48+
49+
operator = '='
50+
operator = config['operator'] if config.key? 'operator'
51+
52+
if config.key? 'value'
53+
val = config['value'].is_a?(String) ? "\"#{config['value']}\"" : config['value']
54+
55+
entry.concat("#{operator}#{val}")
56+
end
57+
end
58+
59+
entry.concat("\n")
60+
end
61+
end

‎manifests/init.pp

+6-1
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@
99
# Only set this, if your platform is not supported or you know,
1010
# what you're doing.
1111
#
12+
# @param package_manage
13+
# Whether or not to manage the sudo package.
14+
#
1215
# @param package_ldap
1316
# Name of the package with ldap support, if ldap_enable is set.
1417
#
@@ -117,6 +120,7 @@
117120
class sudo (
118121
Boolean $enable = true,
119122
Optional[String[1]] $package = $sudo::params::package,
123+
Boolean $package_manage = true,
120124
Optional[String[1]] $package_ldap = $sudo::params::package_ldap,
121125
String[1] $package_ensure = $sudo::params::package_ensure,
122126
Optional[String[1]] $package_source = $sudo::params::package_source,
@@ -144,6 +148,7 @@
144148
Enum['absent','password','nopassword'] $wheel_config = $sudo::params::wheel_config,
145149
Optional[Array[String[1]]] $sudoreplay_discard = undef,
146150
Hash $configs = {},
151+
Sudo::Defaults $defaults = $sudo::params::defaults,
147152
) inherits sudo::params {
148153
case $enable {
149154
true: {
@@ -169,7 +174,7 @@
169174
}
170175
default: { fail('no $ldap_enable is set') }
171176
}
172-
if $package_real {
177+
if $package_real and $package_manage {
173178
class { 'sudo::package':
174179
package => $package_real,
175180
package_ensure => $package_ensure,

0 commit comments

Comments
 (0)