justinclayton/puppet-module-sudo

Change default setting of a "Default" without a template and without rewriting RHEL defaults

Closed this issue · 1 comments

OS: RHEL 7
I want to keep all OS defaults, but change "env_reset" to false, and require_tty to false.

How do I do this without creating my own template, and, without manually setting all defaults in my manifest?

If I set keep_os_defaults to true, I get two files in /etc/sudoers.d/. One with Defaults require_tty (and other OS defaults), and the other with Defaults !require_tty (which is the setting that I want). This doesn't actually do what I want, as sudo now complains I have no tty :(

@felipe1982 - I did end up coming up with a workaround without doing anything extra and I've confirmed everything still works.

Background Info

We only configure sudo rules for users through /etc/sudoers.d/<username> and as you mentioned above, if you were not aware, sudo will parse the files in ASCII alphabetical order. Which means a filename like /etc/sudoers.d/amy or /etc/sudoers.d/melvin would get trumped by /etc/sudoers.d/os_defaults.

Solution:

    # sudo::conf expects that we have a template, but we cheat and turn it
    # into a string using stdlib join.

    # NOTE: you must use double quotes here or RUBY won't honor the newline.
    $user_sudoers_entry = join($sudo_rules, "\n")

    # In order to handle ASCII lexical parsing of sudoers.d/<filename> we
    # have to hack around how os_defaualts is presented on the system.
    class { 'sudo':
      keep_os_defaults => false,
    } ->

    sudo::conf { $title:
      content => $user_sudoers_entry,
    } ->

    sudo::defaults { '00_os_defaults':
      defaults_hash => $sudo::params::os_defaults,
    }

I only configure suders through a single module so this is what I cam up with and it works very well. I also wrote tests around it in our implementation to make sure it works.

I'm thinking I'll probably see if @justinclayton will accept a pull request to address this issue? If so, i'll get one in and make sure to write tests as well.