From ac278d226c0c732f2956cc9318ba9e684a039783 Mon Sep 17 00:00:00 2001
From: Robert Fairburn <robertfairburn@Roberts-MacBook-Pro.local>
Date: Wed, 9 Jul 2014 12:21:58 -0500
Subject: [PATCH] Extend defaults section of sudoers to permit the following:
 Default_Type ::= 'Defaults' |                  'Defaults' '@' Host_List |    
              'Defaults' ':' User_List |                  'Defaults' '!'
 Cmnd_List |                  'Defaults' '>' Runas_List

---
 pillar.example        | 16 +++++++++++++---
 sudoers/files/sudoers | 23 +++++++++++++++++++++--
 2 files changed, 34 insertions(+), 5 deletions(-)

diff --git a/pillar.example b/pillar.example
index 77a5194..f3807b8 100644
--- a/pillar.example
+++ b/pillar.example
@@ -4,9 +4,19 @@ sudoers:
   groups:
     sudo: 'ALL=(ALL) NOPASSWD: ALL'
   defaults:
-    - env_reset
-    - mail_badpass
-    - secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+    generic:
+      - env_rset
+      - mail_badpass
+      - secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+    user_list:
+      johndoe: '!requiretty'
+      ADMINS: '!lecture'
+    host_list:
+      www1: 'log_year, logfile=/var/log/sudo.log'
+    command_list:
+      PROCESSES: 'noexec'
+    runas_list:
+      root: '!set_logname'
   aliases:
     hosts:
       WEBSERVERS:
diff --git a/sudoers/files/sudoers b/sudoers/files/sudoers
index 2c6c2e0..ad1c35d 100644
--- a/sudoers/files/sudoers
+++ b/sudoers/files/sudoers
@@ -9,7 +9,12 @@
     {%- set users = sudoers.get('users', {'root': 'ALL=(ALL:ALL) ALL'}) %}
     {%- set groups = sudoers.get('groups', {'sudo': 'ALL=(ALL:ALL) ALL'}) %}
   {%- else %}
-    {%- set defaults = sudoers.get('defaults', []) %}
+    {%- set defaults = sudoers.get('defaults', {}) %}
+    {%- set generic_defaults = defaults.get('generic', []) %}
+    {%- set user_list_defaults = defaults.get('user_list', {}) %}
+    {%- set host_list_defaults = defaults.get('host_list', {}) %}
+    {%- set command_list_defaults = defaults.get('command_list', {}) %}
+    {%- set runas_list_defaults = defaults.get('runas_list', {}) %}
     {%- set users = sudoers.get('users', {}) %}
     {%- set groups = sudoers.get('groups', {}) %}
   {%- endif %}
@@ -29,9 +34,23 @@
 # This file is managed by salt
 #
 
-{% for default in defaults -%}
+# Defaults specification
+{% for default in generic_defaults -%}
 Defaults {{ default }}
 {% endfor %}
+{%- for user,spec in user_list_defaults.items() %}
+Defaults:{{ user }} {{ spec }}
+{%- endfor %}
+{%- for host,spec in host_list_defaults.items() %}
+Defaults@{{ host }} {{ spec }}
+{%- endfor %}
+{%- for command,spec in command_list_defaults.items() %}
+Defaults!{{ user }} {{ spec }}
+{%- endfor %}
+{%- for user,spec in runas_list_defaults.items() %}
+Defaults>{{ user }} {{ spec }}
+{%- endfor %}
+
 # Host alias specification
 {%- for name,hosts in host_aliases.items() %}
 Host_Alias {{ name }} = {{ ",".join(hosts) }}