Faidon Liambotis has uploaded a new change for review.
https://gerrit.wikimedia.org/r/180777
Change subject: sudo: actually make the lintin safety checks work
......................................................................
sudo: actually make the lintin safety checks work
The current linting Execs, as shamelessly stolen from the admin module,
had a logic error in which it tried doing "exit 0" as means to handle
the ensure => absent case, but ended up doing it unconditionally,
therefore rendering the whole check moot!
There's two ways to fix this: either move the "test -e" check to a
separate onlyif parameter, or guard the whole Exec with an "if $ensure
== present" check. The latter feels cleaner, so just do this.
Change-Id: I9b29d3e093446cbd602087d27718f6813cfe372b
---
M modules/sudo/manifests/group.pp
M modules/sudo/manifests/user.pp
2 files changed, 14 insertions(+), 12 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/77/180777/1
diff --git a/modules/sudo/manifests/group.pp b/modules/sudo/manifests/group.pp
index 107dfc6..2ee2118 100644
--- a/modules/sudo/manifests/group.pp
+++ b/modules/sudo/manifests/group.pp
@@ -40,11 +40,12 @@
content => template('sudo/sudoers.erb'),
}
- exec { "sudo_group_${title}_linting":
- command => "rm -f ${filename} && false",
- unless => "test -e ${filename} && visudo -cf ${filename} || exit
0",
- path => '/bin:/usr/bin:/usr/sbin',
- refreshonly => true,
- subscribe => File[$filename],
+ if $ensure == 'present' {
+ exec { "sudo_group_${title}_linting":
+ command => "/bin/rm -f ${filename} && /bin/false",
+ unless => "/usr/sbin/visudo -cqf ${filename}",
+ refreshonly => true,
+ subscribe => File[$filename],
+ }
}
}
diff --git a/modules/sudo/manifests/user.pp b/modules/sudo/manifests/user.pp
index 48fb4a4..6a64fdc 100644
--- a/modules/sudo/manifests/user.pp
+++ b/modules/sudo/manifests/user.pp
@@ -40,11 +40,12 @@
content => template('sudo/sudoers.erb'),
}
- exec { "sudo_user_${title}_linting":
- command => "rm -f ${filename} && false",
- unless => "test -e ${filename} && visudo -cf ${filename} || exit
0",
- path => '/bin:/usr/bin:/usr/sbin',
- refreshonly => true,
- subscribe => File[$filename],
+ if $ensure == 'present' {
+ exec { "sudo_user_${title}_linting":
+ command => "/bin/rm -f ${filename} && /bin/false",
+ unless => "/usr/sbin/visudo -cqf ${filename}",
+ refreshonly => true,
+ subscribe => File[$filename],
+ }
}
}
--
To view, visit https://gerrit.wikimedia.org/r/180777
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I9b29d3e093446cbd602087d27718f6813cfe372b
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Faidon Liambotis <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
