mirror of
https://github.com/ansible-collections/community.general.git
synced 2025-07-28 15:41:22 -07:00
[PR #5703/77fde030 backport][stable-6] Add support for host restriction in sudoers module (#5716)
Add support for host restriction in sudoers module (#5703)
* Add support to restrict privileges by host
* Missing comma
* Making linter happy.
* Add version 6.2.0 as when sudoers host parameter added
Co-authored-by: Felix Fontein <felix@fontein.de>
* Changelog fragment for PR #5703
* Test for sudoers host-based restriction
Co-authored-by: Felix Fontein <felix@fontein.de>
(cherry picked from commit 77fde030cd
)
Co-authored-by: Laurence <laurence+github@entek.org.uk>
This commit is contained in:
parent
02e6a8608f
commit
bc50b48205
3 changed files with 36 additions and 2 deletions
|
@ -131,6 +131,19 @@
|
|||
src: "{{ sudoers_path }}/my-sudo-rule-6"
|
||||
register: rule_6_contents
|
||||
|
||||
- name: Create rule to allow user to sudo just on host-1
|
||||
community.general.sudoers:
|
||||
name: my-sudo-rule-7
|
||||
state: present
|
||||
user: alice
|
||||
host: host-1
|
||||
commands: /usr/local/bin/command
|
||||
register: rule_7
|
||||
|
||||
- name: Grab contents of my-sudo-rule-7
|
||||
ansible.builtin.slurp:
|
||||
src: "{{ sudoers_path }}/my-sudo-rule-7"
|
||||
register: rule_7_contents
|
||||
|
||||
- name: Revoke rule 1
|
||||
community.general.sudoers:
|
||||
|
@ -229,6 +242,7 @@
|
|||
- "rule_4_contents['content'] | b64decode == '%students ALL=NOPASSWD: /usr/local/bin/command\n'"
|
||||
- "rule_5_contents['content'] | b64decode == 'alice ALL=NOPASSWD: /usr/local/bin/command\n'"
|
||||
- "rule_6_contents['content'] | b64decode == 'alice ALL=(bob)NOPASSWD: /usr/local/bin/command\n'"
|
||||
- "rule_7_contents['content'] | b64decode == 'alice host-1=NOPASSWD: /usr/local/bin/command\n'"
|
||||
|
||||
- name: Check revocation stat
|
||||
ansible.builtin.assert:
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue