1
0
Fork 0
mirror of synced 2024-05-25 11:31:11 -04:00
formula-sudoers/sudoers/files/sudoers
Niels Abspoel 2fa535ec3a
Merge pull request #43 from ze42/dictsort
dictsort: ensure the dict order is stable
2018-10-27 23:43:45 +02:00

113 lines
4 KiB
Plaintext

{%- if (not included) %}
{%- set sudoers = pillar.get('sudoers', {}) %}
{%- if grains['os_family'] == 'Debian' %}
{%- set defaults = sudoers.get('defaults', {'generic': [
'env_reset',
'mail_badpass',
'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"'
]}) %}
{%- set generic_defaults = defaults.get('generic', []) %}
{%- set user_list_defaults = defaults.get('user_list', {}) %}
{%- set host_list_defaults = defaults.get('host_list', {}) %}
{%- set command_list_defaults = defaults.get('command_list', {}) %}
{%- set runas_list_defaults = defaults.get('runas_list', {}) %}
{%- set users = sudoers.get('users', {'root': ['ALL=(ALL:ALL) ALL']}) %}
{%- set groups = sudoers.get('groups', {'sudo': ['ALL=(ALL:ALL) ALL']}) %}
{%- set netgroups = sudoers.get('netgroups', {}) %}
{%- else %}
{%- set defaults = sudoers.get('defaults', {}) %}
{%- set generic_defaults = defaults.get('generic', []) %}
{%- set user_list_defaults = defaults.get('user_list', {}) %}
{%- set host_list_defaults = defaults.get('host_list', {}) %}
{%- set command_list_defaults = defaults.get('command_list', {}) %}
{%- set runas_list_defaults = defaults.get('runas_list', {}) %}
{%- set users = sudoers.get('users', {}) %}
{%- set groups = sudoers.get('groups', {}) %}
{%- set netgroups = sudoers.get('netgroups', {}) %}
{%- endif %}
{%- set includedir = sudoers.get('includedir', '/etc/sudoers.d') -%}
{%- else %}
{%- set defaults = sudoers.get('defaults', {}) %}
{%- set generic_defaults = defaults.get('generic', []) %}
{%- set user_list_defaults = defaults.get('user_list', {}) %}
{%- set host_list_defaults = defaults.get('host_list', {}) %}
{%- set command_list_defaults = defaults.get('command_list', {}) %}
{%- set runas_list_defaults = defaults.get('runas_list', {}) %}
{%- set users = sudoers.get('users', {}) %}
{%- set groups = sudoers.get('groups', {}) %}
{%- set netgroups = sudoers.get('netgroups', {}) %}
{%- set includedir = sudoers.get('includedir', None) %}
{%- endif %}
{%- set aliases = sudoers.get('aliases', {}) %}
{%- set host_aliases = aliases.get('hosts', {}) %}
{%- set user_aliases = aliases.get('users', {}) %}
{%- set command_aliases = aliases.get('commands', {}) %}
{%- set runas_aliases = aliases.get('runas', {}) -%}
#
# This file is managed by salt
#
# Defaults specification
{% for default in generic_defaults -%}
Defaults {{ default }}
{% endfor %}
{%- for user,spec in user_list_defaults|dictsort %}
Defaults:{{ user }} {{ spec }}
{%- endfor %}
{%- for host,spec in host_list_defaults|dictsort %}
Defaults@{{ host }} {{ spec }}
{%- endfor %}
{%- for command,spec in command_list_defaults|dictsort %}
Defaults!{{ command }} {{ spec }}
{%- endfor %}
{%- for runas,spec in runas_list_defaults|dictsort %}
Defaults>{{ runas }} {{ spec }}
{%- endfor %}
# Host alias specification
{%- for name,hosts in host_aliases|dictsort %}
Host_Alias {{ name }} = {{ ",".join(hosts) }}
{%- endfor %}
# User alias specification
{%- for name,users in user_aliases|dictsort %}
User_Alias {{ name }} = {{ ",".join(users) }}
{%- endfor %}
# Cmnd alias specification
{%- for name,commands in command_aliases|dictsort %}
Cmnd_Alias {{ name }} = {{ ",".join(commands) }}
{%- endfor %}
# Runas alias specification
{%- for name,runas in runas_aliases|dictsort %}
Runas_Alias {{ name }} = {{ ",".join(runas) }}
{%- endfor %}
# User privilege specification
{%- for user,specs in users|dictsort %}
{%- for spec in specs %}
{{ user }} {{ spec }}
{%- endfor %}
{%- endfor %}
# Group privilege specification
{%- for group,specs in groups|dictsort %}
{%- for spec in specs %}
%{{ group }} {{ spec }}
{%- endfor %}
{%- endfor %}
# Netgroup privilege specification
{%- for netgroup,specs in netgroups.items() %}
{%- for spec in specs %}
+{{ netgroup }} {{ spec }}
{%- endfor %}
{%- endfor %}
{% if includedir %}
## Read drop-in files from /etc/sudoers.d
## (the '#' here does not indicate a comment)
#includedir {{ includedir }}
{% endif %}