saz / puppet-sudo

Manage sudo with Puppet on Debian-, RedHat- and SUSE-based linux distributions and some BSDs
Other
105 stars 216 forks source link

sudo-syntax-check error in puppet-sudo version 3.0.5 #60

Closed flakrat closed 10 years ago

flakrat commented 10 years ago

Howdy, I'm getting the following when attempting to apply the catalog to a node:

Info: Applying configuration version '1397793067'
Error: Could not apply complete catalog: Found 1 dependency cycle:
(Exec[sudo-syntax-check for file /etc/sudoers.d/5_sysadmins] => File[5_sysadmins] => Exec[sudo-syntax-check for file /etc/sudoers.d/5_sysadmins])
Try the '--graph' option and opening the resulting '.dot' file in OmniGraffle or GraphViz
Notice: Finished catalog run in 0.32 seconds

If I comment out the following line, the /etc/sudoers.d/5_sysadmins file gets created and manually running "visudo -c " shows that it checks out OK. I'm also able to successfully run the sudo command for my user who is part of the wheel group.

    require => Exec["sudo-syntax-check for file ${cur_file}"],

The following is how I'm configuring the node in hiera

sudo::conf:
  sysadmins:
    priority: 5
    content: "%wheel ALL=(ALL) ALL"
tosmi commented 10 years ago

i think the culprit are lines 87 and 88 in conf.pp:

notify => $notify_real, require => Exec["sudo-syntax-check for file ${cur_file}"],

notify adds an implicit dependency to run the file resource before exec and require explicity requires to run exec before file.

i try to test/fix this asap.

flakrat commented 10 years ago

I have tested the updated code (v3.0.6) and it resolved the issue, thanks for the fix!

hnnsngl commented 7 years ago

As of now, the file resource does have a validate_cmd attribute, that lends itself to this: ... validate_cmd => '/usr/sbin/visudo --check --file=%', ...