feat(ordering): optionally append includefiles to main config

2024-11-16 22:25:34 -05:00 · 2021-08-19 00:05:27 +01:00 · 2021-08-19 00:05:27 +01:00 · 751eff7218
commit 751eff7218
parent 25cd2cf0e3
29 changed files with 41 additions and 1 deletions
--- a/docs/README.rst
+++ b/docs/README.rst
@ -51,7 +51,7 @@ Set up the sudoers file
 ``sudoers.included``
 ^^^^^^^^^^^^^^^^^^^^

-Set up an additional sudoers included file
+Set up an additional sudoers included file.


 Testing
--- a/pillar.example
+++ b/pillar.example
@ -63,3 +63,9 @@ sudoers:
      netgroups:
        other_netgroup:
          - 'ALL=(ALL) ALL'
+  # ordering is important. The sudoers manpage says when multiple
+  # entries match, the last match is used. However, if we do not
+  # manage the main config, our included files may not match last.
+  # To guarantee included files match last, set 'true' below to append
+  # each '#include <includefile>' to sudoers file.
+  append_included_files_to_endof_main_config: true
--- a/sudoers/defaults.yaml
+++ b/sudoers/defaults.yaml
@ -10,3 +10,4 @@ sudoers:
  execprefix: /usr/sbin
  includedir: /etc/sudoers.d
  included_files: {}
+  append_included_files_to_endof_main_config: false
--- a/sudoers/included/init.sls
+++ b/sudoers/included/init.sls
@ -0,0 +1,5 @@
+# -*- coding: utf-8 -*-
+# vim: ft=sls
+
+include:
+  - .install
--- a/sudoers/included/install.sls
+++ b/sudoers/included/install.sls
@ -40,5 +40,9 @@ sudoers include {{ included_file }}:
      - file: {{ sudoers.configpath }}/sudoers
    - require_in:
      - file: {{ sudoers.includedir }}
+    {% elif sudoers.append_included_files_to_endof_main_config %}
+  file.append:
+    - name: {{ sudoers.configpath }}/sudoers
+    - text: '#include {{ sudoers.configpath }}/sudoers.d/{{ included_file }}'
    {% endif %}
 {% endfor %}
--- a/test/integration/default/files/_mapdata/almalinux-8.yaml
+++ b/test/integration/default/files/_mapdata/almalinux-8.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/amazonlinux-1.yaml
+++ b/test/integration/default/files/_mapdata/amazonlinux-1.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/amazonlinux-2.yaml
+++ b/test/integration/default/files/_mapdata/amazonlinux-2.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/arch-base-latest.yaml
+++ b/test/integration/default/files/_mapdata/arch-base-latest.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/centos-6.yaml
+++ b/test/integration/default/files/_mapdata/centos-6.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/centos-7.yaml
+++ b/test/integration/default/files/_mapdata/centos-7.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/centos-8.yaml
+++ b/test/integration/default/files/_mapdata/centos-8.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/debian-10.yaml
+++ b/test/integration/default/files/_mapdata/debian-10.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/debian-11.yaml
+++ b/test/integration/default/files/_mapdata/debian-11.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/debian-9.yaml
+++ b/test/integration/default/files/_mapdata/debian-9.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/fedora-31.yaml
+++ b/test/integration/default/files/_mapdata/fedora-31.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/fedora-32.yaml
+++ b/test/integration/default/files/_mapdata/fedora-32.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/fedora-33.yaml
+++ b/test/integration/default/files/_mapdata/fedora-33.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/fedora-34.yaml
+++ b/test/integration/default/files/_mapdata/fedora-34.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/gentoo-2-sysd.yaml
+++ b/test/integration/default/files/_mapdata/gentoo-2-sysd.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/gentoo-2-sysv.yaml
+++ b/test/integration/default/files/_mapdata/gentoo-2-sysv.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/opensuse-15.yaml
+++ b/test/integration/default/files/_mapdata/opensuse-15.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/opensuse-tumbleweed.yaml
+++ b/test/integration/default/files/_mapdata/opensuse-tumbleweed.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/oraclelinux-7.yaml
+++ b/test/integration/default/files/_mapdata/oraclelinux-7.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/oraclelinux-8.yaml
+++ b/test/integration/default/files/_mapdata/oraclelinux-8.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/rockylinux-8.yaml
+++ b/test/integration/default/files/_mapdata/rockylinux-8.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/ubuntu-16.yaml
+++ b/test/integration/default/files/_mapdata/ubuntu-16.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/ubuntu-18.yaml
+++ b/test/integration/default/files/_mapdata/ubuntu-18.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults:
--- a/test/integration/default/files/_mapdata/ubuntu-20.yaml
+++ b/test/integration/default/files/_mapdata/ubuntu-20.yaml
@ -20,6 +20,7 @@ values:
      - millert
      - dowdy
      - mikef
+  append_included_files_to_endof_main_config: false
  arch: amd64
  configpath: /etc
  defaults: