mirror of https://github.com/ansible/ansible.git
Refactor _fixup_perms2 to remove way-nested logic (#70701)
Change: - Refactoring to make it harder to get wrong and easier to read. - Generalize become_unprivileged tests and fix some that never worked but also never failed. Test Plan: - CI, new units/integration tests Signed-off-by: Rick Elrod <rick@elrod.me>pull/70776/head
Rick Elrod
4 years ago
committed by
GitHub
parent
707e8b6e0c
commit
69472a5f8d
@ -0,0 +1,2 @@
|
||||
minor_changes:
|
||||
- Restructured _fixup_perms2() in ansible.plugins.action to make it more linear
|
||||
@ -0,0 +1,14 @@
|
||||
# Make coding more python3-ish
|
||||
from __future__ import (absolute_import, division, print_function)
|
||||
__metaclass__ = type
|
||||
|
||||
from ansible.plugins.action import ActionBase
|
||||
|
||||
|
||||
class ActionModule(ActionBase):
|
||||
|
||||
def run(self, tmp=None, task_vars=None):
|
||||
result = super(ActionModule, self).run(tmp, task_vars)
|
||||
result.update(self._execute_module('ping', task_vars=task_vars))
|
||||
result['tmpdir'] = self._connection._shell.tmpdir
|
||||
return result
|
||||
@ -1,8 +0,0 @@
|
||||
- name: Clean up host
|
||||
hosts: ssh
|
||||
gather_facts: yes
|
||||
|
||||
# Default, just noted here to be explicit about what is happening:
|
||||
remote_user: root
|
||||
roles:
|
||||
- cleanup_become_unprivileged
|
||||
@ -0,0 +1,53 @@
|
||||
- name: Clean up host and remove unprivileged users
|
||||
hosts: ssh
|
||||
gather_facts: yes
|
||||
remote_user: root
|
||||
tasks:
|
||||
# Do this first so we can use tilde notation while the user still exists
|
||||
- name: Delete homedirs
|
||||
file:
|
||||
path: '~{{ item }}'
|
||||
state: absent
|
||||
with_items:
|
||||
- unpriv1
|
||||
- unpriv2
|
||||
|
||||
- name: Delete users
|
||||
user:
|
||||
name: "{{ item }}"
|
||||
state: absent
|
||||
force: yes # I think this is needed in case pipelining is used and the session remains open
|
||||
with_items:
|
||||
- unpriv1
|
||||
- unpriv2
|
||||
|
||||
- name: Delete groups
|
||||
group:
|
||||
name: "{{ item }}"
|
||||
state: absent
|
||||
with_items:
|
||||
- acommongroup
|
||||
- unpriv1
|
||||
- unpriv2
|
||||
|
||||
- name: Fix sudoers.d path for FreeBSD
|
||||
set_fact:
|
||||
sudoers_etc: /usr/local/etc
|
||||
when: ansible_distribution == 'FreeBSD'
|
||||
|
||||
- name: Fix sudoers.d path for everything else
|
||||
set_fact:
|
||||
sudoers_etc: /etc
|
||||
when: ansible_distribution != 'FreeBSD'
|
||||
|
||||
- name: Undo OpenSUSE
|
||||
lineinfile:
|
||||
path: "{{ sudoers_etc }}/sudoers"
|
||||
regexp: '^### Defaults targetpw'
|
||||
line: 'Defaults targetpw'
|
||||
backrefs: yes
|
||||
|
||||
- name: Nuke custom sudoers file
|
||||
file:
|
||||
path: "{{ sudoers_etc }}/sudoers.d/unpriv1"
|
||||
state: absent
|
||||
@ -0,0 +1,35 @@
|
||||
- name: Cleanup (as root)
|
||||
hosts: ssh
|
||||
gather_facts: yes
|
||||
remote_user: root
|
||||
tasks:
|
||||
- name: Remove group for unprivileged users
|
||||
group:
|
||||
name: commongroup
|
||||
state: absent
|
||||
|
||||
- name: Check if /usr/bin/setfacl exists
|
||||
stat:
|
||||
path: /usr/bin/setfacl
|
||||
register: usr_bin_setfacl
|
||||
|
||||
- name: Check if /bin/setfacl exists
|
||||
stat:
|
||||
path: /bin/setfacl
|
||||
register: bin_setfacl
|
||||
|
||||
- name: Set path to setfacl
|
||||
set_fact:
|
||||
setfacl_path: /usr/bin/setfacl
|
||||
when: usr_bin_setfacl.stat.exists
|
||||
|
||||
- name: Set path to setfacl
|
||||
set_fact:
|
||||
setfacl_path: /bin/setfacl
|
||||
when: bin_setfacl.stat.exists
|
||||
|
||||
- name: chmod +x setfacl
|
||||
file:
|
||||
path: "{{ setfacl_path }}"
|
||||
mode: a+x
|
||||
when: setfacl_path is defined
|
||||
@ -0,0 +1,43 @@
|
||||
- name: Prep (as root)
|
||||
hosts: ssh
|
||||
gather_facts: yes
|
||||
remote_user: root
|
||||
tasks:
|
||||
- name: Create group for unprivileged users
|
||||
group:
|
||||
name: commongroup
|
||||
|
||||
- name: Add them to the group
|
||||
user:
|
||||
name: "{{ item }}"
|
||||
groups: commongroup
|
||||
append: yes
|
||||
with_items:
|
||||
- unpriv1
|
||||
- unpriv2
|
||||
|
||||
- name: Check if /usr/bin/setfacl exists
|
||||
stat:
|
||||
path: /usr/bin/setfacl
|
||||
register: usr_bin_setfacl
|
||||
|
||||
- name: Check if /bin/setfacl exists
|
||||
stat:
|
||||
path: /bin/setfacl
|
||||
register: bin_setfacl
|
||||
|
||||
- name: Set path to setfacl
|
||||
set_fact:
|
||||
setfacl_path: /usr/bin/setfacl
|
||||
when: usr_bin_setfacl.stat.exists
|
||||
|
||||
- name: Set path to setfacl
|
||||
set_fact:
|
||||
setfacl_path: /bin/setfacl
|
||||
when: bin_setfacl.stat.exists
|
||||
|
||||
- name: chmod -x setfacl to disable it
|
||||
file:
|
||||
path: "{{ setfacl_path }}"
|
||||
mode: a-x
|
||||
when: setfacl_path is defined
|
||||
@ -0,0 +1,36 @@
|
||||
- name: Tests for ANSIBLE_COMMON_REMOTE_GROUP functionality
|
||||
hosts: ssh
|
||||
gather_facts: yes
|
||||
remote_user: unpriv1
|
||||
|
||||
tasks:
|
||||
- name: foo
|
||||
action: tmpdir
|
||||
register: tmpdir
|
||||
become_user: unpriv2
|
||||
become: yes
|
||||
|
||||
- name: run whoami with become
|
||||
command: whoami
|
||||
register: whoami
|
||||
become_user: unpriv2
|
||||
become: yes
|
||||
|
||||
- set_fact:
|
||||
stat_cmd: stat -c '%U %G' {{ tmpdir.tmpdir }}/*
|
||||
when: ansible_distribution not in ['MacOSX', 'FreeBSD']
|
||||
|
||||
- set_fact:
|
||||
stat_cmd: stat -f '%Su %Sg' {{ tmpdir.tmpdir }}/*
|
||||
when: ansible_distribution in ['MacOSX', 'FreeBSD']
|
||||
|
||||
- name: Ensure we tested the right fallback
|
||||
shell: "{{ stat_cmd }}"
|
||||
register: stat
|
||||
become_user: unpriv2
|
||||
become: yes
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- whoami.stdout == "unpriv2"
|
||||
- stat.stdout == 'unpriv1 commongroup'
|
||||
@ -1,7 +1,10 @@
|
||||
[ssh]
|
||||
ssh-pipelining ansible_ssh_pipelining=true
|
||||
#ssh-no-pipelining ansible_ssh_pipelining=false
|
||||
#ssh-pipelining ansible_ssh_pipelining=true
|
||||
ssh-no-pipelining ansible_ssh_pipelining=false
|
||||
[ssh:vars]
|
||||
ansible_host=localhost
|
||||
ansible_connection=ssh
|
||||
ansible_python_interpreter="{{ ansible_playbook_python }}"
|
||||
|
||||
[all:vars]
|
||||
ansible_python_interpreter="{{ ansible_playbook_python }}"
|
||||
@ -1 +0,0 @@
|
||||
hello I was copied
|
||||
@ -1,58 +0,0 @@
|
||||
- name: Run a command
|
||||
shell: whoami
|
||||
register: whoami
|
||||
|
||||
# TODO: We ignore_errors here because atomic_move has some really weird edge
|
||||
# cases and gives different behavior based on whether the tmpdir we are copying
|
||||
# from is on the same partition as the target or not, among other things. There
|
||||
# is probably work to be done there to either unify the behavior if possible, or
|
||||
# if not, document/add a warning.
|
||||
#
|
||||
# In what follows, unpriv1 is remote_user and unpriv2 is become_user. Both
|
||||
# users are unprivileged.
|
||||
#
|
||||
# In particular, given a system (FreeBSD in my testing, but probably any *nix)
|
||||
# with a single partition, when we connect (as unpriv1) and become unpriv2,
|
||||
# the file ends up being unpriv1:commongroup. We can't chown it after that
|
||||
# since we are become_user, so the file remains owned by unpriv1.
|
||||
#
|
||||
# But when we have multiple partitions, os.rename() in atomic_move fails, and
|
||||
# we end up falling back to a whole new bunch of logic. In the end the file
|
||||
# ends up being creted as unpriv2 and is unpriv2:unpriv2_login_group.
|
||||
#
|
||||
# This creates a bunch of inconsistency and really should be documented better
|
||||
# but the relevant part for *this* test is that in the single-partition case,
|
||||
# we cannot chmod in the `if creating` branch of atomic_move since we do not
|
||||
# own the file. That will generate an error.
|
||||
- name: Copy a file
|
||||
copy:
|
||||
src: baz.txt
|
||||
dest: ~/uh-oh
|
||||
owner: unpriv2
|
||||
group: notcoolenoughforroot
|
||||
mode: 0644
|
||||
ignore_errors: yes
|
||||
|
||||
- name: See if the file exists
|
||||
stat:
|
||||
path: ~/uh-oh
|
||||
register: uh_oh_stat
|
||||
|
||||
#- name: Get files in /var/tmp
|
||||
# find:
|
||||
# paths: "/var/tmp/"
|
||||
# patterns: 'ansible*'
|
||||
# file_type: directory
|
||||
# register: found
|
||||
#
|
||||
#- name: Get latest ansible tmp dir
|
||||
# set_fact:
|
||||
# tmpdir: "{{ found.files | sort(attribute='mtime') | last }}"
|
||||
#
|
||||
#- debug: var=tmpdir
|
||||
|
||||
- assert:
|
||||
that:
|
||||
- whoami.stdout == 'unpriv2'
|
||||
- uh_oh_stat.stat.exists
|
||||
#- tmpdir.gr_name == 'notcoolenoughforroot'
|
||||
@ -1,74 +0,0 @@
|
||||
# Do this first so we can use tilde notation while the user still exists
|
||||
- name: Delete homedirs
|
||||
file:
|
||||
path: '~{{ item }}'
|
||||
state: absent
|
||||
with_items:
|
||||
- unpriv1
|
||||
- unpriv2
|
||||
|
||||
- name: Delete users
|
||||
user:
|
||||
name: "{{ item }}"
|
||||
state: absent
|
||||
force: yes # I think this is needed in case pipelining is used and the session remains open
|
||||
with_items:
|
||||
- unpriv1
|
||||
- unpriv2
|
||||
|
||||
- name: Delete groups
|
||||
group:
|
||||
name: "{{ item }}"
|
||||
state: absent
|
||||
with_items:
|
||||
- notcoolenoughforroot
|
||||
- unpriv1
|
||||
- unpriv2
|
||||
|
||||
- name: Fix sudoers.d path for FreeBSD
|
||||
set_fact:
|
||||
sudoers_etc: /usr/local/etc
|
||||
when: ansible_distribution == 'FreeBSD'
|
||||
|
||||
- name: Fix sudoers.d path for everything else
|
||||
set_fact:
|
||||
sudoers_etc: /etc
|
||||
when: ansible_distribution != 'FreeBSD'
|
||||
|
||||
- name: Undo OpenSUSE
|
||||
lineinfile:
|
||||
path: "{{ sudoers_etc }}/sudoers"
|
||||
regexp: '^### Defaults targetpw'
|
||||
line: 'Defaults targetpw'
|
||||
backrefs: yes
|
||||
|
||||
- name: Nuke custom sudoers file
|
||||
file:
|
||||
path: "{{ sudoers_etc }}/sudoers.d/unpriv1"
|
||||
state: absent
|
||||
|
||||
- name: Check if /usr/bin/setfacl exists
|
||||
stat:
|
||||
path: /usr/bin/setfacl
|
||||
register: usr_bin_setfacl
|
||||
|
||||
- name: Check if the /bin/setfacl exists
|
||||
stat:
|
||||
path: /bin/setfacl
|
||||
register: bin_setfacl
|
||||
|
||||
- name: Set path to setfacl
|
||||
set_fact:
|
||||
setfacl_path: /usr/bin/setfacl
|
||||
when: usr_bin_setfacl.stat.exists
|
||||
|
||||
- name: Set path to setfacl
|
||||
set_fact:
|
||||
setfacl_path: /bin/setfacl
|
||||
when: bin_setfacl.stat.exists
|
||||
|
||||
- name: chmod +x setfacl
|
||||
file:
|
||||
path: "{{ setfacl_path }}"
|
||||
mode: +x
|
||||
when: setfacl_path is defined
|
||||
@ -1,128 +0,0 @@
|
||||
---
|
||||
####################################################################
|
||||
# NOTE! Any destructive changes you make here... Undo them in
|
||||
# cleanup_become_unprivileged so that they don't affect other tests.
|
||||
####################################################################
|
||||
|
||||
- name: Create groups for unprivileged users
|
||||
group:
|
||||
name: "{{ item }}"
|
||||
with_items:
|
||||
- notcoolenoughforroot
|
||||
- unpriv1
|
||||
- unpriv2
|
||||
|
||||
# MacOS requires unencrypted password
|
||||
- name: Set password for unpriv1 (MacOSX)
|
||||
set_fact:
|
||||
password: 'iWishIWereCoolEnoughForRoot!'
|
||||
when: ansible_distribution == 'MacOSX'
|
||||
|
||||
- name: Set password for unpriv1 (everything else)
|
||||
set_fact:
|
||||
password: $6$CRuKRUfAoVwibjUI$1IEOISMFAE/a0VG73K9QsD0uruXNPLNkZ6xWg4Sk3kZIXwv6.YJLECzfNjn6pu8ay6XlVcj2dUvycLetL5Lgx1
|
||||
when: ansible_distribution != 'MacOSX'
|
||||
|
||||
# This user is special. It gets a password so we can sudo as it
|
||||
# (we set the sudo password in runme.sh) and it gets wheel so it can
|
||||
# `become` unpriv2 without an overly complex sudoers file.
|
||||
- name: Create first unprivileged user
|
||||
user:
|
||||
name: unpriv1
|
||||
groups: unpriv1,notcoolenoughforroot
|
||||
append: yes
|
||||
password: "{{ password }}"
|
||||
|
||||
- name: Create second unprivileged user
|
||||
user:
|
||||
name: unpriv2
|
||||
groups: unpriv2,notcoolenoughforroot
|
||||
append: yes
|
||||
|
||||
- name: Create .ssh for unpriv1
|
||||
file:
|
||||
path: ~unpriv1/.ssh
|
||||
state: directory
|
||||
owner: unpriv1
|
||||
group: unpriv1
|
||||
mode: 0700
|
||||
|
||||
- name: Set authorized key for unpriv1
|
||||
copy:
|
||||
src: ~root/.ssh/authorized_keys
|
||||
dest: ~unpriv1/.ssh/authorized_keys
|
||||
remote_src: yes
|
||||
owner: unpriv1
|
||||
group: unpriv1
|
||||
mode: 0600
|
||||
|
||||
# Without this we get:
|
||||
# "Failed to connect to the host via ssh: "System is booting up. Unprivileged
|
||||
# users are not permitted to log in yet. Please come back later."
|
||||
- name: Nuke /run/nologin
|
||||
file:
|
||||
path: /run/nologin
|
||||
state: absent
|
||||
|
||||
- name: Fix sudoers.d path for FreeBSD
|
||||
set_fact:
|
||||
sudoers_etc: /usr/local/etc
|
||||
when: ansible_distribution == 'FreeBSD'
|
||||
|
||||
- name: Fix sudoers.d path for everything else
|
||||
set_fact:
|
||||
sudoers_etc: /etc
|
||||
when: sudoers_etc is not defined
|
||||
|
||||
- name: Chown group for bsd and osx
|
||||
set_fact:
|
||||
chowngroup: wheel
|
||||
when: ansible_distribution in ('FreeBSD', 'MacOSX')
|
||||
|
||||
- name: Chown group for everything else
|
||||
set_fact:
|
||||
chowngroup: root
|
||||
when: chowngroup is not defined
|
||||
|
||||
- name: Make it so unpriv1 can sudo (Chapter 1)
|
||||
copy:
|
||||
dest: "{{ sudoers_etc }}/sudoers.d/unpriv1"
|
||||
content: unpriv1 ALL=(ALL) ALL
|
||||
owner: root
|
||||
group: "{{ chowngroup }}"
|
||||
mode: 0644
|
||||
|
||||
# OpenSUSE has a weird sudo default here and requires the root pw
|
||||
# instead of the user pw. Undo that setting, we can clean it up later.
|
||||
- name: Make it so unpriv1 can sudo (Chapter 2 - The Return Of the OpenSUSE)
|
||||
lineinfile:
|
||||
dest: "{{ sudoers_etc }}/sudoers"
|
||||
regexp: '^Defaults targetpw'
|
||||
line: '### Defaults targetpw'
|
||||
backrefs: yes
|
||||
|
||||
- name: Check if /usr/bin/setfacl exists
|
||||
stat:
|
||||
path: /usr/bin/setfacl
|
||||
register: usr_bin_setfacl
|
||||
|
||||
- name: Check if the /bin/setfacl exists
|
||||
stat:
|
||||
path: /bin/setfacl
|
||||
register: bin_setfacl
|
||||
|
||||
- name: Set path to setfacl
|
||||
set_fact:
|
||||
setfacl_path: /usr/bin/setfacl
|
||||
when: usr_bin_setfacl.stat.exists
|
||||
|
||||
- name: Set path to setfacl
|
||||
set_fact:
|
||||
setfacl_path: /bin/setfacl
|
||||
when: bin_setfacl.stat.exists
|
||||
|
||||
- name: chmod -x setfacl
|
||||
file:
|
||||
path: "{{ setfacl_path }}"
|
||||
mode: -x
|
||||
when: setfacl_path is defined
|
||||
@ -1,14 +1,35 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -ux
|
||||
set -eux
|
||||
|
||||
ansible-playbook setup.yml -i inventory -v "$@"
|
||||
begin_sandwich() {
|
||||
ansible-playbook setup_unpriv_users.yml -i inventory -v "$@"
|
||||
}
|
||||
|
||||
export ANSIBLE_KEEP_REMOTE_FILES=True
|
||||
export ANSIBLE_COMMON_REMOTE_GROUP=notcoolenoughforroot
|
||||
export ANSIBLE_BECOME_PASS='iWishIWereCoolEnoughForRoot!'
|
||||
end_sandwich() {
|
||||
unset ANSIBLE_KEEP_REMOTE_FILES
|
||||
unset ANSIBLE_COMMON_REMOTE_GROUP
|
||||
unset ANSIBLE_BECOME_PASS
|
||||
|
||||
ansible-playbook test.yml -i inventory -v "$@"
|
||||
# Do a few cleanup tasks (nuke users, groups, and homedirs, undo config changes)
|
||||
ansible-playbook cleanup_unpriv_users.yml -i inventory -v "$@"
|
||||
|
||||
# Do a few cleanup tasks (nuke users, groups, and homedirs, undo config changes)
|
||||
ansible-playbook cleanup.yml -i inventory -v "$@"
|
||||
# We do these last since they do things like remove groups and will error
|
||||
# if there are still users in them.
|
||||
for pb in */cleanup.yml; do
|
||||
ansible-playbook "$pb" -i inventory -v "$@"
|
||||
done
|
||||
}
|
||||
|
||||
trap "end_sandwich \"\$@\"" EXIT
|
||||
|
||||
# Common group tests
|
||||
begin_sandwich "$@"
|
||||
ansible-playbook common_remote_group/setup.yml -i inventory -v "$@"
|
||||
export ANSIBLE_KEEP_REMOTE_FILES=True
|
||||
export ANSIBLE_COMMON_REMOTE_GROUP=commongroup
|
||||
export ANSIBLE_BECOME_PASS='iWishIWereCoolEnoughForRoot!'
|
||||
ANSIBLE_ACTION_PLUGINS="$(pwd)/action_plugins"
|
||||
export ANSIBLE_ACTION_PLUGINS
|
||||
ansible-playbook common_remote_group/test.yml -i inventory -v "$@"
|
||||
end_sandwich "$@"
|
||||
|
||||
@ -1,8 +0,0 @@
|
||||
- name: Set up host
|
||||
hosts: ssh
|
||||
gather_facts: yes
|
||||
|
||||
# Default, just noted here to be explicit about what is happening:
|
||||
remote_user: root
|
||||
roles:
|
||||
- setup_become_unprivileged
|
||||
@ -0,0 +1,109 @@
|
||||
####################################################################
|
||||
# NOTE! Any destructive changes you make here... Undo them in
|
||||
# cleanup_become_unprivileged so that they don't affect other tests.
|
||||
####################################################################
|
||||
- name: Set up host and create unprivileged users
|
||||
hosts: ssh
|
||||
gather_facts: yes
|
||||
remote_user: root
|
||||
tasks:
|
||||
- name: Create groups for unprivileged users
|
||||
group:
|
||||
name: "{{ item }}"
|
||||
with_items:
|
||||
- unpriv1
|
||||
- unpriv2
|
||||
|
||||
# MacOS requires unencrypted password
|
||||
- name: Set password for unpriv1 (MacOSX)
|
||||
set_fact:
|
||||
password: 'iWishIWereCoolEnoughForRoot!'
|
||||
when: ansible_distribution == 'MacOSX'
|
||||
|
||||
- name: Set password for unpriv1 (everything else)
|
||||
set_fact:
|
||||
password: $6$CRuKRUfAoVwibjUI$1IEOISMFAE/a0VG73K9QsD0uruXNPLNkZ6xWg4Sk3kZIXwv6.YJLECzfNjn6pu8ay6XlVcj2dUvycLetL5Lgx1
|
||||
when: ansible_distribution != 'MacOSX'
|
||||
|
||||
# This user is special. It gets a password so we can sudo as it
|
||||
# (we set the sudo password in runme.sh) and it gets wheel so it can
|
||||
# `become` unpriv2 without an overly complex sudoers file.
|
||||
- name: Create first unprivileged user
|
||||
user:
|
||||
name: unpriv1
|
||||
group: unpriv1
|
||||
password: "{{ password }}"
|
||||
|
||||
- name: Create second unprivileged user
|
||||
user:
|
||||
name: unpriv2
|
||||
group: unpriv2
|
||||
|
||||
- name: Special case group add for macOS
|
||||
user:
|
||||
name: unpriv1
|
||||
groups: com.apple.access_ssh
|
||||
append: yes
|
||||
when: ansible_distribution == 'MacOSX'
|
||||
|
||||
- name: Create .ssh for unpriv1
|
||||
file:
|
||||
path: ~unpriv1/.ssh
|
||||
state: directory
|
||||
owner: unpriv1
|
||||
group: unpriv1
|
||||
mode: 0700
|
||||
|
||||
- name: Set authorized key for unpriv1
|
||||
copy:
|
||||
src: ~root/.ssh/authorized_keys
|
||||
dest: ~unpriv1/.ssh/authorized_keys
|
||||
remote_src: yes
|
||||
owner: unpriv1
|
||||
group: unpriv1
|
||||
mode: 0600
|
||||
|
||||
# Without this we get:
|
||||
# "Failed to connect to the host via ssh: "System is booting up. Unprivileged
|
||||
# users are not permitted to log in yet. Please come back later."
|
||||
- name: Nuke /run/nologin
|
||||
file:
|
||||
path: /run/nologin
|
||||
state: absent
|
||||
|
||||
- name: Fix sudoers.d path for FreeBSD
|
||||
set_fact:
|
||||
sudoers_etc: /usr/local/etc
|
||||
when: ansible_distribution == 'FreeBSD'
|
||||
|
||||
- name: Fix sudoers.d path for everything else
|
||||
set_fact:
|
||||
sudoers_etc: /etc
|
||||
when: sudoers_etc is not defined
|
||||
|
||||
- name: Set chown group for bsd and osx
|
||||
set_fact:
|
||||
chowngroup: wheel
|
||||
when: ansible_distribution in ('FreeBSD', 'MacOSX')
|
||||
|
||||
- name: Chown group for everything else
|
||||
set_fact:
|
||||
chowngroup: root
|
||||
when: chowngroup is not defined
|
||||
|
||||
- name: Make it so unpriv1 can sudo (Chapter 1)
|
||||
copy:
|
||||
dest: "{{ sudoers_etc }}/sudoers.d/unpriv1"
|
||||
content: unpriv1 ALL=(ALL) ALL
|
||||
owner: root
|
||||
group: "{{ chowngroup }}"
|
||||
mode: 0644
|
||||
|
||||
# OpenSUSE has a weird sudo default here and requires the root pw
|
||||
# instead of the user pw. Undo that setting, we can clean it up later.
|
||||
- name: Make it so unpriv1 can sudo (Chapter 2 - The Return Of the OpenSUSE)
|
||||
lineinfile:
|
||||
dest: "{{ sudoers_etc }}/sudoers"
|
||||
regexp: '^Defaults targetpw'
|
||||
line: '### Defaults targetpw'
|
||||
backrefs: yes
|
||||
@ -1,8 +0,0 @@
|
||||
- name: Run the test
|
||||
hosts: ssh
|
||||
gather_facts: yes
|
||||
remote_user: unpriv1
|
||||
become: yes
|
||||
become_user: unpriv2
|
||||
roles:
|
||||
- become_unprivileged
|
||||
Loading…
Reference in New Issue