mirror of
https://github.com/ansible-collections/community.general.git
synced 2024-09-14 20:13:21 +02:00
[PR #7415/df66885f backport][stable-8] Ipa sudorule/add deny options (#7526)
Ipa sudorule/add deny options (#7415)
* Introduce options to include 'deny' commands and command groups
* Adding Changelog fragment
* Apply suggestions from code review
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update changelogs/fragments/add-ipa-sudorule-deny-cmd.yml
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update plugins/modules/ipa_sudorule.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update plugins/modules/ipa_sudorule.py
Co-authored-by: Felix Fontein <felix@fontein.de>
---------
Co-authored-by: Ris Adams <ris@risadams.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
(cherry picked from commit df66885fa4
)
Co-authored-by: Ris Adams <5329119+risadams@users.noreply.github.com>
This commit is contained in:
parent
be8c05bf65
commit
52ffc4eb7c
2 changed files with 40 additions and 0 deletions
2
changelogs/fragments/add-ipa-sudorule-deny-cmd.yml
Normal file
2
changelogs/fragments/add-ipa-sudorule-deny-cmd.yml
Normal file
|
@ -0,0 +1,2 @@
|
||||||
|
minor_changes:
|
||||||
|
- ipa_sudorule - adds options to include denied commands or command groups (https://github.com/ansible-collections/community.general/pull/7415).
|
|
@ -47,6 +47,22 @@ options:
|
||||||
type: list
|
type: list
|
||||||
elements: str
|
elements: str
|
||||||
version_added: 2.0.0
|
version_added: 2.0.0
|
||||||
|
deny_cmd:
|
||||||
|
description:
|
||||||
|
- List of denied commands assigned to the rule.
|
||||||
|
- If an empty list is passed all commands will be removed from the rule.
|
||||||
|
- If option is omitted commands will not be checked or changed.
|
||||||
|
type: list
|
||||||
|
elements: str
|
||||||
|
version_added: 8.1.0
|
||||||
|
deny_cmdgroup:
|
||||||
|
description:
|
||||||
|
- List of denied command groups assigned to the rule.
|
||||||
|
- If an empty list is passed all command groups will be removed from the rule.
|
||||||
|
- If option is omitted command groups will not be checked or changed.
|
||||||
|
type: list
|
||||||
|
elements: str
|
||||||
|
version_added: 8.1.0
|
||||||
description:
|
description:
|
||||||
description:
|
description:
|
||||||
- Description of the sudo rule.
|
- Description of the sudo rule.
|
||||||
|
@ -246,6 +262,12 @@ class SudoRuleIPAClient(IPAClient):
|
||||||
def sudorule_add_allow_command_group(self, name, item):
|
def sudorule_add_allow_command_group(self, name, item):
|
||||||
return self._post_json(method='sudorule_add_allow_command', name=name, item={'sudocmdgroup': item})
|
return self._post_json(method='sudorule_add_allow_command', name=name, item={'sudocmdgroup': item})
|
||||||
|
|
||||||
|
def sudorule_add_deny_command(self, name, item):
|
||||||
|
return self._post_json(method='sudorule_add_deny_command', name=name, item={'sudocmd': item})
|
||||||
|
|
||||||
|
def sudorule_add_deny_command_group(self, name, item):
|
||||||
|
return self._post_json(method='sudorule_add_deny_command', name=name, item={'sudocmdgroup': item})
|
||||||
|
|
||||||
def sudorule_remove_allow_command(self, name, item):
|
def sudorule_remove_allow_command(self, name, item):
|
||||||
return self._post_json(method='sudorule_remove_allow_command', name=name, item=item)
|
return self._post_json(method='sudorule_remove_allow_command', name=name, item=item)
|
||||||
|
|
||||||
|
@ -303,6 +325,8 @@ def ensure(module, client):
|
||||||
cmd = module.params['cmd']
|
cmd = module.params['cmd']
|
||||||
cmdgroup = module.params['cmdgroup']
|
cmdgroup = module.params['cmdgroup']
|
||||||
cmdcategory = module.params['cmdcategory']
|
cmdcategory = module.params['cmdcategory']
|
||||||
|
deny_cmd = module.params['deny_cmd']
|
||||||
|
deny_cmdgroup = module.params['deny_cmdgroup']
|
||||||
host = module.params['host']
|
host = module.params['host']
|
||||||
hostcategory = module.params['hostcategory']
|
hostcategory = module.params['hostcategory']
|
||||||
hostgroup = module.params['hostgroup']
|
hostgroup = module.params['hostgroup']
|
||||||
|
@ -359,6 +383,16 @@ def ensure(module, client):
|
||||||
if not module.check_mode:
|
if not module.check_mode:
|
||||||
client.sudorule_add_allow_command_group(name=name, item=cmdgroup)
|
client.sudorule_add_allow_command_group(name=name, item=cmdgroup)
|
||||||
|
|
||||||
|
if deny_cmd is not None:
|
||||||
|
changed = category_changed(module, client, 'cmdcategory', ipa_sudorule) or changed
|
||||||
|
if not module.check_mode:
|
||||||
|
client.sudorule_add_deny_command(name=name, item=deny_cmd)
|
||||||
|
|
||||||
|
if deny_cmdgroup is not None:
|
||||||
|
changed = category_changed(module, client, 'cmdcategory', ipa_sudorule) or changed
|
||||||
|
if not module.check_mode:
|
||||||
|
client.sudorule_add_deny_command_group(name=name, item=deny_cmdgroup)
|
||||||
|
|
||||||
if runasusercategory is not None:
|
if runasusercategory is not None:
|
||||||
changed = category_changed(module, client, 'iparunasusercategory', ipa_sudorule) or changed
|
changed = category_changed(module, client, 'iparunasusercategory', ipa_sudorule) or changed
|
||||||
|
|
||||||
|
@ -433,6 +467,8 @@ def main():
|
||||||
cmdgroup=dict(type='list', elements='str'),
|
cmdgroup=dict(type='list', elements='str'),
|
||||||
cmdcategory=dict(type='str', choices=['all']),
|
cmdcategory=dict(type='str', choices=['all']),
|
||||||
cn=dict(type='str', required=True, aliases=['name']),
|
cn=dict(type='str', required=True, aliases=['name']),
|
||||||
|
deny_cmd=dict(type='list', elements='str'),
|
||||||
|
deny_cmdgroup=dict(type='list', elements='str'),
|
||||||
description=dict(type='str'),
|
description=dict(type='str'),
|
||||||
host=dict(type='list', elements='str'),
|
host=dict(type='list', elements='str'),
|
||||||
hostcategory=dict(type='str', choices=['all']),
|
hostcategory=dict(type='str', choices=['all']),
|
||||||
|
@ -447,7 +483,9 @@ def main():
|
||||||
runasextusers=dict(type='list', elements='str'))
|
runasextusers=dict(type='list', elements='str'))
|
||||||
module = AnsibleModule(argument_spec=argument_spec,
|
module = AnsibleModule(argument_spec=argument_spec,
|
||||||
mutually_exclusive=[['cmdcategory', 'cmd'],
|
mutually_exclusive=[['cmdcategory', 'cmd'],
|
||||||
|
['cmdcategory', 'deny_cmd'],
|
||||||
['cmdcategory', 'cmdgroup'],
|
['cmdcategory', 'cmdgroup'],
|
||||||
|
['cmdcategory', 'deny_cmdgroup'],
|
||||||
['hostcategory', 'host'],
|
['hostcategory', 'host'],
|
||||||
['hostcategory', 'hostgroup'],
|
['hostcategory', 'hostgroup'],
|
||||||
['usercategory', 'user'],
|
['usercategory', 'user'],
|
||||||
|
|
Loading…
Reference in a new issue