ansible-collections/community.general
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2025-06-27 10:40:22 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Add support for host restriction in sudoers module (#5703)

Browse source 
* Add support to restrict privileges by host

* Missing comma

* Making linter happy.

* Add version 6.2.0 as when sudoers host parameter added

Co-authored-by: Felix Fontein <felix@fontein.de>

* Changelog fragment for PR #5703

* Test for sudoers host-based restriction

Co-authored-by: Felix Fontein <felix@fontein.de>
This commit is contained in:
Laurence 2022-12-20 11:49:11 +00:00 • committed by GitHub
parent 2b39470a77
commit 77fde030cd
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 36 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

14
tests/integration/targets/sudoers/tasks/main.yml
View file

@ -131,6 +131,19 @@
src: "{{ sudoers_path }}/my-sudo-rule-6"
register: rule_6_contents
- name: Create rule to allow user to sudo just on host-1
community.general.sudoers:
name: my-sudo-rule-7
state: present
user: alice
host: host-1
commands: /usr/local/bin/command
register: rule_7
- name: Grab contents of my-sudo-rule-7
ansible.builtin.slurp:
src: "{{ sudoers_path }}/my-sudo-rule-7"
register: rule_7_contents
- name: Revoke rule 1
community.general.sudoers:
@ -229,6 +242,7 @@
- "rule_4_contents['content'] | b64decode == '%students ALL=NOPASSWD: /usr/local/bin/command\n'"
- "rule_5_contents['content'] | b64decode == 'alice ALL=NOPASSWD: /usr/local/bin/command\n'"
- "rule_6_contents['content'] | b64decode == 'alice ALL=(bob)NOPASSWD: /usr/local/bin/command\n'"
- "rule_7_contents['content'] | b64decode == 'alice host-1=NOPASSWD: /usr/local/bin/command\n'"
- name: Check revocation stat
ansible.builtin.assert: