fix(config): remove dictsort that breaks sudoers
in bc62b6e5
dictsort was applied to the pillar entries. But in the
sudoers file *order matters* so, using `dictsort`, breaks it.
From man 5 sudoers:
> When multiple entries match for a user, they are
> applied in order. Where there are multiple matches, the last match
> is used (which is not necessarily the most specific match).
Removed `dictsort` from the {users,groups,netgroups} specifications.
BREAKING CHANGE: sudoers entries' order will change and might break
existing configuration. You should check your pillars and rendering.
This commit is contained in:
parent
b8a8f6f45c
commit
7ee2569b45
|
@ -84,24 +84,24 @@ Cmnd_Alias {{ name }} = {{ ",".join(commands) }}
|
||||||
Runas_Alias {{ name }} = {{ ",".join(runas) }}
|
Runas_Alias {{ name }} = {{ ",".join(runas) }}
|
||||||
{%- endfor %}
|
{%- endfor %}
|
||||||
|
|
||||||
# User privilege specification
|
# Netgroup privilege specification
|
||||||
{%- for user,specs in users|dictsort %}
|
{%- for netgroup,specs in netgroups.items() %}
|
||||||
{%- for spec in specs %}
|
{%- for spec in specs %}
|
||||||
{{ user }} {{ spec }}
|
+{{ netgroup }} {{ spec }}
|
||||||
{%- endfor %}
|
{%- endfor %}
|
||||||
{%- endfor %}
|
{%- endfor %}
|
||||||
|
|
||||||
# Group privilege specification
|
# Group privilege specification
|
||||||
{%- for group,specs in groups|dictsort %}
|
{%- for group,specs in groups.items() %}
|
||||||
{%- for spec in specs %}
|
{%- for spec in specs %}
|
||||||
%{{ group }} {{ spec }}
|
%{{ group }} {{ spec }}
|
||||||
{%- endfor %}
|
{%- endfor %}
|
||||||
{%- endfor %}
|
{%- endfor %}
|
||||||
|
|
||||||
# Netgroup privilege specification
|
# User privilege specification
|
||||||
{%- for netgroup,specs in netgroups.items() %}
|
{%- for user,specs in users.items() %}
|
||||||
{%- for spec in specs %}
|
{%- for spec in specs %}
|
||||||
+{{ netgroup }} {{ spec }}
|
{{ user }} {{ spec }}
|
||||||
{%- endfor %}
|
{%- endfor %}
|
||||||
{%- endfor %}
|
{%- endfor %}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue