ansible-collections/community.general
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2025-07-28 07:31:23 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

Add noexec support to sudoers (#7983)

Browse source 
* Add noexec support to sudoers

* Add changelog fragment #7983

* Fix yml formatting in fragment 7983

* Apply suggestions from code review

Co-authored-by: Felix Fontein <felix@fontein.de>

---------

Co-authored-by: Felix Fontein <felix@fontein.de>
This commit is contained in:
adaniaud 2024-02-23 05:36:45 +00:00 • committed by GitHub
commit 49bd9cbd3c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 40 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

15
tests/integration/targets/sudoers/tasks/main.yml
View file

@ -159,6 +159,20 @@
src: "{{ sudoers_path }}/my-sudo-rule-8"
register: rule_8_contents
- name: Create rule with noexec parameters
community.general.sudoers:
name: my-sudo-rule-9
state: present
user: alice
commands: /usr/local/bin/command
noexec: true
register: rule_9
- name: Grab contents of my-sudo-rule-9
ansible.builtin.slurp:
src: "{{ sudoers_path }}/my-sudo-rule-9"
register: rule_9_contents
- name: Revoke rule 1
community.general.sudoers:
name: my-sudo-rule-1
@ -257,6 +271,7 @@
- "rule_6_contents['content'] | b64decode == 'alice ALL=(bob)NOPASSWD: /usr/local/bin/command\n'"
- "rule_7_contents['content'] | b64decode == 'alice host-1=NOPASSWD: /usr/local/bin/command\n'"
- "rule_8_contents['content'] | b64decode == 'alice ALL=NOPASSWD:SETENV: /usr/local/bin/command\n'"
- "rule_9_contents['content'] | b64decode == 'alice ALL=NOEXEC:NOPASSWD: /usr/local/bin/command\n'"
- name: Check revocation stat
ansible.builtin.assert: