ansible-collections/community.general
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2025-04-25 11:51:26 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Ensure managed sudoers config files have 0440 permissions (#4814) (#4828)

Browse source 
* Ensure sudoers config files are created with 0440 permissions to appease visudo validation

* Remove change not required by the bugfix

* Add changelog fragment for 4814 sudoers file permissions

* Update changelogs/fragments/4814-sudoers-file-permissions.yml

Co-authored-by: Felix Fontein <felix@fontein.de>

* Have less oct casting

Co-authored-by: Felix Fontein <felix@fontein.de>

Co-authored-by: Felix Fontein <felix@fontein.de>
(cherry picked from commit 2d1e58663c)

Co-authored-by: Jon Ellis <ellis.jp@gmail.com>
This commit is contained in:
patchback[bot] 2022-06-12 08:59:53 +02:00 • committed by GitHub
parent c28ae26636
commit 1206900488
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 24 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
plugins/modules/system/sudoers.py
View file

@ -115,6 +115,8 @@ from ansible.module_utils.common.text.converters import to_native
class Sudoers(object):
FILE_MODE = 0o440
def __init__(self, module):
self.check_mode = module.check_mode
self.name = module.params['name']
@ -134,6 +136,8 @@ class Sudoers(object):
with open(self.file, 'w') as f:
f.write(self.content())
os.chmod(self.file, self.FILE_MODE)
def delete(self):
if self.check_mode:
return
@ -145,7 +149,12 @@ class Sudoers(object):
def matches(self):
with open(self.file, 'r') as f:
return f.read() == self.content()
content_matches = f.read() == self.content()
current_mode = os.stat(self.file).st_mode & 0o777
mode_matches = current_mode == self.FILE_MODE
return content_matches and mode_matches
def content(self):
if self.user: