1
0
Fork 0
mirror of synced 2024-12-22 06:01:07 -05:00

fix(config): remove dictsort that breaks sudoers

in bc62b6e5 dictsort was applied to the pillar entries. But in the
sudoers file *order matters* so, using `dictsort`, breaks it.

From man 5 sudoers:

> When multiple entries match for a user, they are
> applied in order.  Where there are multiple matches, the last match
> is used (which is not necessarily the most specific match).

Removed `dictsort` from the {users,groups,netgroups} specifications.

BREAKING CHANGE: sudoers entries' order will change and might break
existing configuration. You should check your pillars and rendering.
This commit is contained in:
Javier Bértoli 2020-08-24 16:18:36 -03:00
parent b8a8f6f45c
commit 7ee2569b45

View file

@ -84,24 +84,24 @@ Cmnd_Alias {{ name }} = {{ ",".join(commands) }}
Runas_Alias {{ name }} = {{ ",".join(runas) }} Runas_Alias {{ name }} = {{ ",".join(runas) }}
{%- endfor %} {%- endfor %}
# User privilege specification # Netgroup privilege specification
{%- for user,specs in users|dictsort %} {%- for netgroup,specs in netgroups.items() %}
{%- for spec in specs %} {%- for spec in specs %}
{{ user }} {{ spec }} +{{ netgroup }} {{ spec }}
{%- endfor %} {%- endfor %}
{%- endfor %} {%- endfor %}
# Group privilege specification # Group privilege specification
{%- for group,specs in groups|dictsort %} {%- for group,specs in groups.items() %}
{%- for spec in specs %} {%- for spec in specs %}
%{{ group }} {{ spec }} %{{ group }} {{ spec }}
{%- endfor %} {%- endfor %}
{%- endfor %} {%- endfor %}
# Netgroup privilege specification # User privilege specification
{%- for netgroup,specs in netgroups.items() %} {%- for user,specs in users.items() %}
{%- for spec in specs %} {%- for spec in specs %}
+{{ netgroup }} {{ spec }} {{ user }} {{ spec }}
{%- endfor %} {%- endfor %}
{%- endfor %} {%- endfor %}