mirror of
https://github.com/ansible-collections/community.general.git
synced 2024-09-14 20:13:21 +02:00
64c51ade1e
(Also a fix for the user module error handling when the user is not present at the time of the return. This can only really be caused by multiple ansible executions).
360 lines
11 KiB
Python
Executable file
360 lines
11 KiB
Python
Executable file
#!/usr/bin/python
|
|
|
|
# (c) 2012, Stephen Fromm <sfromm@gmail.com>
|
|
#
|
|
# This file is part of Ansible
|
|
#
|
|
# Ansible is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# Ansible is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
try:
|
|
import json
|
|
except ImportError:
|
|
import simplejson as json
|
|
import os
|
|
import re
|
|
import pwd
|
|
import grp
|
|
import shlex
|
|
import subprocess
|
|
import sys
|
|
import syslog
|
|
try:
|
|
import spwd
|
|
HAVE_SPWD=True
|
|
except:
|
|
HAVE_SPWD=False
|
|
|
|
USERADD = "/usr/sbin/useradd"
|
|
USERMOD = "/usr/sbin/usermod"
|
|
USERDEL = "/usr/sbin/userdel"
|
|
|
|
def exit_json(rc=0, **kwargs):
|
|
if 'name' in kwargs:
|
|
add_user_info(kwargs)
|
|
print json.dumps(kwargs)
|
|
sys.exit(rc)
|
|
|
|
def fail_json(**kwargs):
|
|
kwargs['failed'] = True
|
|
exit_json(rc=1, **kwargs)
|
|
|
|
def add_user_info(kwargs):
|
|
name = kwargs['name']
|
|
if user_exists(name):
|
|
kwargs['state'] = 'present'
|
|
info = user_info(name)
|
|
if info == False:
|
|
if 'failed' in kwargs:
|
|
kwargs['notice'] = "failed to look up user name: %s" % name
|
|
else:
|
|
kwargs['msg'] = "failed to look up user name: %s" % name
|
|
kwargs['failed'] = True
|
|
return kwargs
|
|
kwargs['uid'] = info[2]
|
|
kwargs['group'] = info[3]
|
|
kwargs['comment'] = info[4]
|
|
kwargs['home'] = info[5]
|
|
kwargs['shell'] = info[6]
|
|
kwargs['createhome'] = os.path.exists(info[5])
|
|
groups = user_group_membership(name)
|
|
if len(groups) > 0:
|
|
kwargs['groups'] = groups
|
|
else:
|
|
kwargs['state'] = 'absent'
|
|
return kwargs
|
|
|
|
def user_del(user, **kwargs):
|
|
cmd = [USERDEL]
|
|
for key in kwargs:
|
|
if key == 'force' and kwargs[key] == 'yes':
|
|
cmd.append('-f')
|
|
elif key == 'remove' and kwargs[key] == 'yes':
|
|
cmd.append('-r')
|
|
cmd.append(user)
|
|
p = subprocess.Popen(cmd, shell=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|
(out, err) = p.communicate()
|
|
rc = p.returncode
|
|
return (rc, out, err)
|
|
|
|
def user_add(user, **kwargs):
|
|
cmd = [USERADD]
|
|
for key in kwargs:
|
|
if key == 'uid' and kwargs[key] is not None:
|
|
cmd.append('-u')
|
|
cmd.append(kwargs[key])
|
|
elif key == 'group' and kwargs[key] is not None:
|
|
if not group_exists(kwargs[key]):
|
|
fail_json(msg="Group %s does not exist" % (kwargs[key]))
|
|
cmd.append('-g')
|
|
cmd.append(kwargs[key])
|
|
elif key == 'groups' and kwargs[key] is not None:
|
|
for g in kwargs[key].split(','):
|
|
if not group_exists(g):
|
|
fail_json(msg="Group %s does not exist" % (g))
|
|
cmd.append('-G')
|
|
cmd.append(kwargs[key])
|
|
elif key == 'comment' and kwargs[key] is not None:
|
|
cmd.append('-c')
|
|
cmd.append(kwargs[key])
|
|
elif key == 'home' and kwargs[key] is not None:
|
|
cmd.append('-d')
|
|
cmd.append(kwargs[key])
|
|
elif key == 'shell' and kwargs[key] is not None:
|
|
cmd.append('-s')
|
|
cmd.append(kwargs[key])
|
|
elif key == 'password' and kwargs[key] is not None:
|
|
cmd.append('-p')
|
|
cmd.append(kwargs[key])
|
|
elif key == 'createhome':
|
|
if kwargs[key] is not None:
|
|
if kwargs[key] == 'yes':
|
|
cmd.append('-m')
|
|
else:
|
|
cmd.append('-M')
|
|
elif key == 'system' and kwargs[key] == 'yes':
|
|
cmd.append('-r')
|
|
cmd.append(user)
|
|
p = subprocess.Popen(cmd, shell=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|
(out, err) = p.communicate()
|
|
rc = p.returncode
|
|
return (rc, out, err)
|
|
|
|
"""
|
|
Without spwd, we would have to resort to reading /etc/shadow
|
|
to get the encrypted string. For now, punt on idempotent password changes.
|
|
"""
|
|
def user_mod(user, **kwargs):
|
|
cmd = [USERMOD]
|
|
info = user_info(user)
|
|
for key in kwargs:
|
|
if key == 'uid':
|
|
if kwargs[key] is not None and info[2] != int(kwargs[key]):
|
|
cmd.append('-u')
|
|
cmd.append(kwargs[key])
|
|
elif key == 'group' and kwargs[key] is not None:
|
|
if not group_exists(kwargs[key]):
|
|
fail_json(msg="Group %s does not exist" % (kwargs[key]))
|
|
ginfo = group_info(group)
|
|
if info[3] != ginfo[2]:
|
|
cmd.append('-g')
|
|
cmd.append(kwargs[key])
|
|
elif key == 'groups' and kwargs[key] is not None:
|
|
current_groups = user_group_membership(user)
|
|
groups = kwargs[key].split(',')
|
|
for g in groups:
|
|
if not group_exists(g):
|
|
fail_json(msg="Group %s does not exist" % (g))
|
|
group_diff = set(sorted(current_groups)).symmetric_difference(set(sorted(groups)))
|
|
groups_need_mod = False
|
|
|
|
if group_diff:
|
|
if kwargs['append'] is not None and kwargs['append'] == 'yes':
|
|
for g in groups:
|
|
if g in group_diff:
|
|
cmd.append('-a')
|
|
groups_need_mod = True
|
|
else:
|
|
groups_need_mod = True
|
|
|
|
if groups_need_mod:
|
|
cmd.append('-G')
|
|
cmd.append(','.join(groups))
|
|
|
|
elif key == 'comment':
|
|
if kwargs[key] is not None and info[4] != kwargs[key]:
|
|
cmd.append('-c')
|
|
cmd.append(kwargs[key])
|
|
elif key == 'home':
|
|
if kwargs[key] is not None and info[5] != kwargs[key]:
|
|
cmd.append('-d')
|
|
cmd.append(kwargs[key])
|
|
elif key == 'shell':
|
|
if kwargs[key] is not None and info[6] != kwargs[key]:
|
|
cmd.append('-s')
|
|
cmd.append(kwargs[key])
|
|
elif key == 'password':
|
|
if kwargs[key] is not None and info[1] != kwargs[key]:
|
|
cmd.append('-p')
|
|
cmd.append(kwargs[key])
|
|
# skip if no changes to be made
|
|
if len(cmd) == 1:
|
|
return (None, '', '')
|
|
cmd.append(user)
|
|
p = subprocess.Popen(cmd, shell=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|
(out, err) = p.communicate()
|
|
rc = p.returncode
|
|
return (rc, out, err)
|
|
|
|
def group_exists(group):
|
|
try:
|
|
if group.isdigit():
|
|
if grp.getgrgid(group):
|
|
return True
|
|
else:
|
|
if grp.getgrnam(group):
|
|
return True
|
|
except KeyError:
|
|
return False
|
|
|
|
def group_info(group):
|
|
if not group_exists(group):
|
|
return False
|
|
if group.isdigit():
|
|
return list(grp.getgrgid(group))
|
|
else:
|
|
return list(grp.getgrnam(group))
|
|
|
|
def user_group_membership(user):
|
|
groups = []
|
|
info = get_pwd_info(user)
|
|
for group in grp.getgrall():
|
|
if user in group[3] and info[3] != group[2]:
|
|
groups.append(group[0])
|
|
return groups
|
|
|
|
def user_exists(user):
|
|
try:
|
|
if pwd.getpwnam(user):
|
|
return True
|
|
except KeyError:
|
|
return False
|
|
|
|
def get_pwd_info(user):
|
|
if not user_exists(user):
|
|
return False
|
|
return list(pwd.getpwnam(user))
|
|
|
|
def user_info(user):
|
|
if not user_exists(user):
|
|
return False
|
|
try:
|
|
info = get_pwd_info(user)
|
|
if HAVE_SPWD:
|
|
sinfo = spwd.getspnam(user)
|
|
except KeyError:
|
|
return False
|
|
if HAVE_SPWD:
|
|
info[1] = sinfo[1]
|
|
return info
|
|
|
|
# ===========================================
|
|
|
|
if not os.path.exists(USERADD):
|
|
if os.path.exists("/sbin/useradd"):
|
|
USERADD = "/sbin/useradd"
|
|
else:
|
|
fail_json(msg="Cannot find useradd")
|
|
if not os.path.exists(USERMOD):
|
|
if os.path.exists("/sbin/usermod"):
|
|
USERMOD = "/sbin/usermod"
|
|
else:
|
|
fail_json(msg="Cannot find usermod")
|
|
if not os.path.exists(USERDEL):
|
|
if os.path.exists("/sbin/userdel"):
|
|
USERDEL = "/sbin/userdel"
|
|
else:
|
|
fail_json(msg="Cannot find userdel")
|
|
|
|
argfile = sys.argv[1]
|
|
args = open(argfile, 'r').read()
|
|
items = shlex.split(args)
|
|
syslog.openlog('ansible-%s' % os.path.basename(__file__))
|
|
log_args = re.sub(r'password=.+ (.*)', r"password=NOT_LOGGING_PASSWORD \1", args)
|
|
syslog.syslog(syslog.LOG_NOTICE, 'Invoked with %s' % log_args)
|
|
|
|
if not len(items):
|
|
fail_json(msg='the module requires arguments -a')
|
|
sys.exit(1)
|
|
|
|
params = {}
|
|
for x in items:
|
|
(k, v) = x.split("=")
|
|
params[k] = v
|
|
|
|
state = params.get('state','present')
|
|
name = params.get('name', None)
|
|
uid = params.get('uid', None)
|
|
group = params.get('group', None)
|
|
groups = params.get('groups', None)
|
|
comment = params.get('comment', None)
|
|
home = params.get('home', None)
|
|
shell = params.get('shell', None)
|
|
password = params.get('password', None)
|
|
|
|
# ===========================================
|
|
# following options are specific to userdel
|
|
force = params.get('force', 'no')
|
|
remove = params.get('remove', 'no')
|
|
|
|
# ===========================================
|
|
# following options are specific to useradd
|
|
createhome = params.get('createhome', 'yes')
|
|
system = params.get('system', 'no')
|
|
|
|
# ===========================================
|
|
# following options are specific to usermod
|
|
append = params.get('append', 'no')
|
|
|
|
if state not in [ 'present', 'absent' ]:
|
|
fail_json(msg='invalid state')
|
|
if createhome not in [ 'yes', 'no' ]:
|
|
fail_json(msg='invalid createhome')
|
|
if system not in ['yes', 'no']:
|
|
fail_json(msg='invalid system')
|
|
if append not in [ 'yes', 'no' ]:
|
|
fail_json(msg='invalid append')
|
|
if force not in ['yes', 'no']:
|
|
fail_json(msg="invalid option for force, requires yes or no (defaults to no)")
|
|
if remove not in ['yes', 'no']:
|
|
fail_json(msg="invalid option for remove, requires yes or no (defaults to no)")
|
|
if name is None:
|
|
fail_json(msg='name is required')
|
|
|
|
rc = None
|
|
out = ''
|
|
err = ''
|
|
result = {}
|
|
result['name'] = name
|
|
if state == 'absent':
|
|
if user_exists(name):
|
|
(rc, out, err) = user_del(name, force=force, remove=remove)
|
|
if rc != 0:
|
|
fail_json(name=name, msg=err)
|
|
result['force'] = force
|
|
result['remove'] = remove
|
|
elif state == 'present':
|
|
if not user_exists(name):
|
|
(rc, out, err) = user_add(name, uid=uid, group=group, groups=groups,
|
|
comment=comment, home=home, shell=shell,
|
|
password=password, createhome=createhome,
|
|
system=system)
|
|
else:
|
|
(rc, out, err) = user_mod(name, uid=uid, group=group, groups=groups,
|
|
comment=comment, home=home, shell=shell,
|
|
password=password, append=append)
|
|
if rc is not None and rc != 0:
|
|
fail_json(name=name, msg=err)
|
|
if password is not None:
|
|
result['password'] = 'NOTLOGGINGPASSWORD'
|
|
|
|
if rc is None:
|
|
result['changed'] = False
|
|
else:
|
|
result['changed'] = True
|
|
if out:
|
|
result['stdout'] = out
|
|
if err:
|
|
result['stderr'] = err
|
|
exit_json(**result)
|
|
sys.exit(0)
|