Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for host restriction in sudoers module #5703

Merged
merged 6 commits into from
Dec 20, 2022
Merged

Add support for host restriction in sudoers module #5703

merged 6 commits into from
Dec 20, 2022

Conversation

loz-hurst
Copy link
Contributor

SUMMARY

Implementation of my feature request: Fixes #5702

ISSUE TYPE
  • Feature Pull Request
COMPONENT NAME

sudoers

ADDITIONAL INFORMATION

Adds ability to set host-based restrictions on privilege escalation managed via sudoers modules. Default behaviour (via default value to new parameter) maintains current behaviour of using the magic ALL value (i.e. no restriction).

@ansibullbot
Copy link
Collaborator

cc @JonEllis @JonEllis0
click here for bot help

@ansibullbot ansibullbot added feature This issue/PR relates to a feature request module module new_contributor Help guide this first time contributor plugins plugin (any type) system labels Dec 18, 2022
@github-actions
Copy link

github-actions bot commented Dec 18, 2022 •
edited
Loading

Docs Build 📝

Thank you for contribution!✨

This PR has been merged and your docs changes will be incorporated when they are next published.

felixfontein
felixfontein reviewed Dec 18, 2022
View reviewed changes
Copy link
Collaborator

@felixfontein felixfontein left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your contribution! Could you please add a changelog fragment? Thanks.

@JonEllis
Copy link
Contributor

Thanks @loz-hurst, I've not used the host option myself, but as the value defaults to ALL as it did before, it seems a safe addition.

loz-hurst added a commit to loz-hurst/community.general that referenced this pull request Dec 19, 2022
@loz-hurst
Changelog fragment for PR ansible-collections#5703
c817036
@loz-hurst
Copy link
Contributor Author

Thanks for your contribution! Could you please add a changelog fragment? Thanks.

Done and thanks for the version added, I wasn't sure what to use there so left it out.

@russoz
Copy link
Collaborator

russoz commented Dec 19, 2022

Thanks for your contribution! Could you please add a changelog fragment? Thanks.

Done and thanks for the version added, I wasn't sure what to use there so left it out.

Hi @loz-hurst Maybe you are missing one git push: The changelog fragment is not in the PR yet.

It would be nice to have one or two tests to demonstrate the use of the new parameter, but the change is very straightforward, so not having new tests will not stop the PR from being merged.

loz-hurst added a commit to loz-hurst/community.general that referenced this pull request Dec 19, 2022
@loz-hurst
Changelog fragment for PR ansible-collections#5703 - now with yml ext…
07ee9b7 
…ension
@loz-hurst
Copy link
Contributor Author

Hi @loz-hurst Maybe you are missing one git push: The changelog fragment is not in the PR yet.

My bad, committed that one to main not patch-1 on my fork. Should be in there now.

It would be nice to have one or two tests to demonstrate the use of the new parameter, but the change is very straightforward, so not having new tests will not stop the PR from being merged.

I'll will try and do this but pushed for time...

russoz
russoz approved these changes Dec 19, 2022
View reviewed changes
Copy link
Collaborator

@russoz russoz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@loz-hurst
Copy link
Contributor Author

loz-hurst commented Dec 19, 2022 •
edited
Loading

It would be nice to have one or two tests to demonstrate the use of the new parameter, but the change is very straightforward, so not having new tests will not stop the PR from being merged.

I can't see any existing tests for the sudoers module - can someone more familiar with this codebase confirm that before I go ahead and create a new test_sudoers unit?

Edit: I think I might open a separate issue for the lack of tests, if that is the case - creating tests for the entire module being a bigger task than adding one for this small piece of functionality.

@felixfontein
Copy link
Collaborator

There are tests, see tests/integration/targets/sudoers/tasks/main.yml.

@felixfontein felixfontein added check-before-release PR will be looked at again shortly before release and merged if possible. backport-6 labels Dec 19, 2022
@ansibullbot ansibullbot added integration tests/integration tests tests labels Dec 20, 2022
@loz-hurst
Copy link
Contributor Author

There are tests, see tests/integration/targets/sudoers/tasks/main.yml.

Sorry about that, this is my first foray into contributing to anything Ansible related.

I've added a test for this functionality to that suite, CI seems happy (which I presume has run the test, not sure which tasks do the integration tests?).

@felixfontein
Copy link
Collaborator

Thanks for adding tests! You can see which group this test runs in in

community.general/tests/integration/targets/sudoers/aliases

Line 5 in cd0bb59

azp/posix/2
- so it's group 2. You can see your task in one of the runs here: https://dev.azure.com/ansible/community.general/_build/results?buildId=63547&view=logs&j=40c88692-9fb4-5c35-6b69-5e083fc3f5c6&t=899bb9b2-728c-552d-02b1-ac8a85b01cba&l=382

@felixfontein felixfontein merged commit 77fde03 into ansible-collections:main Dec 20, 2022
@patchback
Copy link

patchback bot commented Dec 20, 2022 •
edited
Loading

Backport to stable-6: 💚 backport PR created

✅ Backport PR branch: patchback/backports/stable-6/77fde030cdb89c1c5532974fb2d827dc1156a097/pr-5703

Backported as #5716

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

patchback bot pushed a commit that referenced this pull request Dec 20, 2022
@loz-hurst @patchback
Add support for host restriction in sudoers module (#5703)
6468c00 
* Add support to restrict privileges by host

* Missing comma

* Making linter happy.

* Add version 6.2.0 as when sudoers host parameter added

Co-authored-by: Felix Fontein <[email protected]>

* Changelog fragment for PR #5703

* Test for sudoers host-based restriction

Co-authored-by: Felix Fontein <[email protected]>
(cherry picked from commit 77fde03)
@patchback patchback bot mentioned this pull request Dec 20, 2022
Merged
@felixfontein
Copy link
Collaborator

@loz-hurst thanks for your contribution!
@JonEllis @russoz thanks for reviewing!

@loz-hurst
Copy link
Contributor Author

Thanks for adding tests! You can see which group this test runs in in

community.general/tests/integration/targets/sudoers/aliases

Line 5 in cd0bb59

azp/posix/2

Thank you, I'm learning so much about community.general development from this simple change! Really appreciate you taking the time to guide me.

felixfontein pushed a commit that referenced this pull request Dec 20, 2022
@patchback @loz-hurst
[PR #5703/77fde030 backport][stable-6] Add support for host restricti…
bc50b48 
…on in sudoers module (#5716)

Add support for host restriction in sudoers module (#5703)

* Add support to restrict privileges by host

* Missing comma

* Making linter happy.

* Add version 6.2.0 as when sudoers host parameter added

Co-authored-by: Felix Fontein <[email protected]>

* Changelog fragment for PR #5703

* Test for sudoers host-based restriction

Co-authored-by: Felix Fontein <[email protected]>
(cherry picked from commit 77fde03)

Co-authored-by: Laurence <[email protected]>
@felixfontein felixfontein removed the check-before-release PR will be looked at again shortly before release and merged if possible. label Dec 23, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@russoz russoz russoz approved these changes

@felixfontein felixfontein felixfontein approved these changes

Assignees
No one assigned
Labels
feature This issue/PR relates to a feature request integration tests/integration module module new_contributor Help guide this first time contributor plugins plugin (any type) system tests tests
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

sudoers module does not support host restrictions
5 participants
@loz-hurst @ansibullbot @JonEllis @russoz @felixfontein