search

saz / puppet-sudo

Manage sudo with Puppet on Debian-, RedHat- and SUSE-based linux distributions and some BSDs
Other
107 stars 215 forks source link

Changed the file resource in conf.pp to use validate_cmd by default #185

Closed fduranti closed 6 years ago

fduranti commented 7 years ago

Change the way visudo checks are done with 2 options.

The 2 options are $delete_on_error and $validate_single.

If $delete_on_error is true the configuration is deleted if visudo -c return an error. If false the error will be only notified but the file will not be deleted. Default is true

if $validate_single is true the file resource will run with validate_cmd to test the single files and if there's an error the old file will not be substituted or deleted. Default is false

Will help with #184 and #125

fduranti commented 7 years ago

I've moved the check of the global sudo so that it will only be executed on a refresh (it's the same check that do the remove file without file remove)

saz commented 7 years ago

Can you please rebase this PR?

fduranti commented 7 years ago

I'll try to do it tomorrow or the day after.

fduranti commented 7 years ago

@saz I've done the rebase but probably some checks should be changed to as the exec command can be different. I can try to change them and push the new commit but I'm not so good at programming testing (and running the test locally). Can you help me with this?

fduranti commented 7 years ago

@saz I was able to do some changing on the tests and now it should be ok.

fduranti commented 6 years ago

@saz any problem with this PR? This should be ok now

fduranti commented 6 years ago

@saz Anything I can do with this PR / change request or it will never be merged/took in consideration?

saz commented 6 years ago

@fduranti If you're able to rebase it, it would be awesome!

fduranti commented 6 years ago

@saz I'll try to do it for tomorrow or the day after. I'm also putting 2 more changes so that the default behaviour of sudo module will remain the same of the actual version also after the PR. 1- the default action for failed visudo -c run will be to delete the file 2- there will be an option to enable to run the file validate_cmd for single sudoers.d file checking

fduranti commented 6 years ago

@saz done some changes and the rebase. This is the description: Change the way visudo checks are done with 2 options.

The 2 options are $delete_on_error and $validate_single.

If $delete_on_error is true the configuration is deleted if visudo -c return an error. If false the error will be only notified but the file will not be deleted. Default is true

if $validate_single is true the file resource will run with validate_cmd to test the single files and if there's an error the old file will not be substituted or deleted. Default is false

fduranti commented 6 years ago

@saz this should be now ok and ready to be merged.