freedomofpress / ansible-role-grsecurity

The documentation and build system for the grsecurity kernel maintained by the Freedom of the Press Foundation for SecureDrop
GNU General Public License v2.0
49 stars 13 forks source link

Refactor elevated privileges logic #62

Closed conorsch closed 8 years ago

conorsch commented 8 years ago

Ansible v2.0.2 introduces a breaking change in how ansible_ssh_user is handled. Prior to 2.0.2, it would automatically be populated with the username used for the SSH connection, but post 2.0.2 it's "null" by default, causing a number of tasks to error.

The pragma is now to use ansible_ssh_user|default(lookup('env', 'USER')), so we'll need to update the associated tasks in these roles to follow suit. Any changes should also work against Ansible v1.9, to make sure we have at least moderate backwards compatibility.

The logic managing privilege escalation was last updated in #50. It may be better to force become: no on the tasks that should be run without sudo privileges, and then the fail check at the beginning of the build role can be removed. Further testing required, naturally.