Add noexec support to sudoers (#7983)
* Add noexec support to sudoers
* Add changelog fragment #7983
* Fix yml formatting in fragment 7983
* Apply suggestions from code review
Co-authored-by: Felix Fontein <felix@fontein.de>
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
(cherry picked from commit 49bd9cbd3c)
Co-authored-by: adaniaud <adaniaud@users.noreply.github.com>
* Add support to restrict privileges by host
* Missing comma
* Making linter happy.
* Add version 6.2.0 as when sudoers host parameter added
Co-authored-by: Felix Fontein <felix@fontein.de>
* Changelog fragment for PR #5703
* Test for sudoers host-based restriction
Co-authored-by: Felix Fontein <felix@fontein.de>
* Use visudo to validate sudoers rules before use
* Replace use of subprocess.Popen with module.run_command
* Switch out apt for package
* Check file mode when verifying file to determine whether something needs to change
* Only install sudo package for debian and redhat environments (when testing)
* Attempt to install sudo on FreeBSD too
* Try just installing sudo for non-darwin machines
* Don't validate file ownership
* Attempt to install sudo on all platforms
* Revert "Attempt to install sudo on all platforms"
This reverts commit b9562a8916.
* Remove file permissions changes from this PR
* Add changelog fragment for 4794 sudoers validation
* Add option to control when sudoers validation is used
* Update changelog fragment
Co-authored-by: Felix Fontein <felix@fontein.de>
* Add version_added to validation property
Co-authored-by: Felix Fontein <felix@fontein.de>
* Also validate failed sudoers validation error message
Co-authored-by: Felix Fontein <felix@fontein.de>
* Make visudo not executable instead of trying to delete it
* Update edge case validation
* Write invalid sudoers file to alternative path to avoid breaking sudo
* Don't try to remove or otherwise modify visudo on Darwin
* Update plugins/modules/system/sudoers.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Remove trailing extra empty line to appease sanity checker
Co-authored-by: Felix Fontein <felix@fontein.de>
* Ensure sudoers config files are created with 0440 permissions to appease visudo validation
* Remove change not required by the bugfix
* Add changelog fragment for 4814 sudoers file permissions
* Update changelogs/fragments/4814-sudoers-file-permissions.yml
Co-authored-by: Felix Fontein <felix@fontein.de>
* Have less oct casting
Co-authored-by: Felix Fontein <felix@fontein.de>
Co-authored-by: Felix Fontein <felix@fontein.de>
* feat: sudoers module supports runas parameter with default of root
* fix: sudoers tests now pass
* chore: add changelog fragment for 4380
* fix: runas feature now a non-breaking change wh no def with no default
* fix: no trailing space in sudoers.py
* Update plugins/modules/system/sudoers.py
Co-authored-by: Felix Fontein <felix@fontein.de>
Co-authored-by: Felix Fontein <felix@fontein.de>
* Add module and pass the andebox validate-modules
* Fixes pep8 and sanity checks
* Add tests (intending that they'll fail)
* Fix pep8 complaint
* Remove stub test_sudoers file
* Add version_added to documentation
Co-authored-by: Andrew Pantuso <ajpantuso@gmail.com>
* Various improvements as suggested by reviewers
* Remove further required: false from documentation
* Make yaml indentation consistently indented
* Remove default for command argument
Co-authored-by: Andrew Pantuso <ajpantuso@gmail.com>
* Refactor check_mode checking as guards
* Update documentation formatting and use to_native
* Update plugins/modules/system/sudoers.py
* Update examples and formatting
* Fix merge conflict
* Update handle
* Add some integration tests
* Update tests to pass yamllint
* Fix assertions typo
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
* Remove wrapping quotes from assertions
* Use >- for long example names
* Add aliases file to sudoers integration tests
* Fix integration test name
* Create new alternative sudoers directory in case /tmp doesn't exist
* Alternative assertion test for checking rule revocation
* Re-quote assertions
* Update version_added to 4.3.0
Co-authored-by: Felix Fontein <felix@fontein.de>
* Uppercase first character of short_description
Co-authored-by: Felix Fontein <felix@fontein.de>
Co-authored-by: Andrew Pantuso <ajpantuso@gmail.com>
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
