Skip to content

Commit

Permalink
fix(config): remove dictsort that breaks sudoers
Browse files Browse the repository at this point in the history
in bc62b6e dictsort was applied to the pillar entries. But in the
sudoers file *order matters* so, using `dictsort`, breaks it.

From man 5 sudoers:

> When multiple entries match for a user, they are
> applied in order.  Where there are multiple matches, the last match
> is used (which is not necessarily the most specific match).

Removed `dictsort` from the {users,groups,netgroups} specifications.

BREAKING CHANGE: sudoers entries' order will change and might break
existing configuration. You should check your pillars and rendering.
  • Loading branch information
javierbertoli committed Aug 24, 2020
1 parent b8a8f6f commit 7ee2569
Showing 1 changed file with 7 additions and 7 deletions.
14 changes: 7 additions & 7 deletions sudoers/files/sudoers
Original file line number Diff line number Diff line change
Expand Up @@ -84,24 +84,24 @@ Cmnd_Alias {{ name }} = {{ ",".join(commands) }}
Runas_Alias {{ name }} = {{ ",".join(runas) }}
{%- endfor %}

# User privilege specification
{%- for user,specs in users|dictsort %}
# Netgroup privilege specification
{%- for netgroup,specs in netgroups.items() %}
{%- for spec in specs %}
{{ user }} {{ spec }}
+{{ netgroup }} {{ spec }}
{%- endfor %}
{%- endfor %}

# Group privilege specification
{%- for group,specs in groups|dictsort %}
{%- for group,specs in groups.items() %}
{%- for spec in specs %}
%{{ group }} {{ spec }}
{%- endfor %}
{%- endfor %}

# Netgroup privilege specification
{%- for netgroup,specs in netgroups.items() %}
# User privilege specification
{%- for user,specs in users.items() %}
{%- for spec in specs %}
+{{ netgroup }} {{ spec }}
{{ user }} {{ spec }}
{%- endfor %}
{%- endfor %}

Expand Down

0 comments on commit 7ee2569

Please sign in to comment.