Validate user sudo rules before applying them

This commit is contained in:
Ash Berlin 2014-04-28 15:52:43 +01:00
parent 3746de7896
commit 192edba9c5

View File

@ -129,6 +129,17 @@ sudoer-{{ name }}:
- group: root
- mode: '0440'
{% if 'sudo_rules' in user %}
{% for rule in user['sudo_rules'] %}
"validate {{ name }} sudo rule {{ loop.index0 }} {{ name }} {{ rule }}":
cmd.run:
- name: 'visudo -cf - <<<"$rule"'
- env:
# Specify the rule via an env var to avoid shell quoting issues.
- rule: "{{ name }} {{ rule }}"
- require_in:
- file: /etc/sudoers.d/{{ name }}
{% endfor %}
/etc/sudoers.d/{{ name }}:
file.append:
- text: