manifests/init.pp

   1 class sudo (
   2     Optional[String[1]] $sudogroup = undef,
   3 ) {
   4     $include_directory = '/etc/sudoers.d'
   5     $file_defaults = {
   6         owner        => "root",
   7         group        => "root",
   8         mode         => "0440",
   9         validate_cmd => "sh -c 'if ! visudo --check --file=%; then cat %; exit 1; fi'",
  10     }
  11     $default_target = '00-defaults'
  12
  13     include sudo::install
  14     include sudo::files
  15     include sudo::defaults
  16
  17     define option (
  18         Optional[String[1]] $parameter = undef,
  19         Variant[String[1],Array[String[1]],Integer,Boolean] $value = true,
  20         Enum['generic','host','user','cmnd','runas'] $context = 'generic',
  21         Optional[Variant[Array[String[1]],String[1]]] $list = undef,
  22         String[1] $target = $sudo::default_target,
  23         Integer $order = 10,
  24         Optional[String[1]] $comment = undef,
  25         Boolean $newline_before = true,
  26     ) {
  27         $param = $parameter ? { undef => $name, default => $parameter }
  28         $_list = type($list) ? { list => $list, default => [$list] }
  29         sudo::internals::add_sudoers_fragment { "${name}":
  30             target  => $target,
  31             content => template("sudo/option_line.erb"),
  32             order   => $order,
  33             comment => $comment,
  34         }
  35     }
  36
  37     define alias (
  38         Enum['host','user','cmnd','runas'] $type,
  39         Optional[Variant[Array[String[1]],String[1]]] $list = undef,
  40         String[1] $target = $sudo::default_target,
  41         Integer $order = 10,
  42         Optional[String[1]] $comment = undef,
  43         Boolean $newline_before = true,
  44     ) {
  45         if $name !~ /^[[:upper:]][[:upper:]_[:digit:]]*$/ {
  46             fail("sudoers alias definition '$name' can only contain uppercase letter, numbers, and the underscore")
  47         }
  48         $_list = type($list) ? { list => $list, default => [$list] }
  49         sudo::internals::add_sudoers_fragment { "${name}":
  50             target  => $target,
  51             content => template("sudo/alias_line.erb"),
  52             order   => $order,
  53             comment => $comment,
  54         }
  55     }
  56
  57     define rule (
  58         Variant[Array[String[1]],String[1]] $who,
  59         Variant[Array[String[1]],String[1]] $where = 'ALL',
  60         Optional[Variant[Array[String[1]],String[1]]] $as_whom = 'ALL',
  61         Optional[Variant[Array[String[1]],String[1]]] $as_group = 'ALL',
  62         Variant[Array[String[1]],String[1]] $what,
  63         String[1] $target = $sudo::default_target,
  64         Integer $order = 10,
  65         Optional[String[1]] $comment = undef,
  66         Boolean $newline_before = true,
  67     )
  68     {
  69         $_comment = $comment ? { undef => $name, default => $comment }
  70         sudo::internals::add_sudoers_fragment { "${name}":
  71             target  => $target,
  72             content => template("sudo/rule_line.erb"),
  73             order   => $order,
  74             comment => $comment,
  75         }
  76     }
  77 }
  78
  79 class sudo::install {
  80
  81     package { "sudo":
  82         ensure => latest,
  83     }
  84 }
  85
  86 class sudo::files (
  87 ) {
  88     $include_directory = $sudo::include_directory
  89     file { default:
  90              *              => $sudo::file_defaults
  91            ;
  92            "/etc/sudoers":
  93                content      => template("sudo/sudoers.erb"),
  94                validate_cmd => "visudo --check --strict --file=%",
  95            ;
  96            "$include_directory":
  97                mode         => "0770",
  98                recurse      => true,
  99                purge        => true,
 100                ignore       => ["*.local","*-local-*","local-*"],
 101            ;
 102            "$include_directory/README":
 103                content      => @(EOT)
 104                                # This directory is managed by Puppet
 105                                #
 106                                # Local files can be named any of:
 107                                #   - local-*
 108                                #   - *-local-*
 109                                #   - *.local
 110                                | EOT
 111            ;
 112     }
 113 }
 114
 115 class sudo::defaults (
 116     Optional[String[1]] $sudogroup = undef,
 117     Boolean $root_may_sudo = true,
 118     Optional[Hash] $generic = undef,
 119     Optional[Hash] $user = undef,
 120     Optional[Hash] $host = undef,
 121     Optional[Hash] $runas = undef,
 122     Optional[Hash] $cmnd = undef,
 123 ) {
 124     $netfacts = $facts[networking] ? { undef => $facts, default => $facts[networking] }
 125     sudo::alias { "LOCALHOST":
 126         type => host,
 127         list => [ "localhost"
 128                 , $netfacts[hostname]
 129                 , $netfacts[fqdn]
 130                 ],
 131     }
 132
 133     if $sudogroup {
 134         $sudogroup_target = "00-sudogroup"
 135
 136         group { "$sudogroup":
 137             ensure => present,
 138             system => true
 139         }->
 140         sudo::rule { "sudogroup":
 141             who     => "%$sudogroup",
 142             where   => "LOCALHOST",
 143             require => Sudo::Alias["LOCALHOST"],
 144             what    => "PASSWD: ALL",
 145             target  => "$sudogroup_target",
 146             comment => "Members of the ${sudogroup} group can use sudo (with password)",
 147         }
 148     }
 149
 150     if $root_may_sudo {
 151         $rootsudo_target = "00-root_may_sudo"
 152
 153         sudo::option { "syslog":
 154             value   => false,
 155             context => user,
 156             list    => "root",
 157             target  => "$rootsudo_target",
 158             comment => "No need to log root usage of sudo",
 159         }->
 160         sudo::rule { "root_may_sudo":
 161             who     => "root",
 162             where   => "LOCALHOST",
 163             require => Sudo::Alias["LOCALHOST"],
 164             what    => "NOPASSWD: ALL",
 165             target  => "$rootsudo_target",
 166             comment => "root may inadvertedly run sudo, so let them:",
 167         }
 168     }
 169
 170     if $generic {
 171         concat::fragment { "sudo::defaults::generic comment":
 172             target  => "sudoers_file_$sudo::default_target",
 173             order   => 14,
 174             content => "\n# Generated from the sudo::defaults::generic class parameter:\n",
 175         }
 176         $generic.each | $param, $value | {
 177             sudo::option { "$param":
 178                 value    => $value,
 179                 order    => 15,
 180                 newline_before => false,
 181                 require  => Concat::Fragment["sudo::defaults::generic comment"],
 182             }
 183         }
 184         concat::fragment { "sudo::defaults::generic end":
 185             target  => "sudoers_file_$sudo::default_target",
 186             order   => 16,
 187             content => "# End sudo::defaults::generic class parameters\n",
 188         }
 189     }
 190
 191     $context_hash = {"user"=>$user,"host"=>$host,"runas"=>$runas,"cmnd"=>$cmnd}
 192     $context_hash.keys.each | $index, $context | {
 193         $defaults = $context_hash[$context]
 194         if $defaults {
 195             concat::fragment { "sudo::defaults::${context} comment":
 196                 target  => "sudoers_$default_target",
 197                 order   => 17 + $index * 3,
 198                 content => "\n# Generated from the sudo::defaults::${context} class parameter:\n",
 199             }
 200             $defaults.each | $list, $items  | {
 201                 $items.each | $param, $value | {
 202                     sudo::option { "${context}_${list}_${param}":
 203                         parameter => $param,
 204                         context   => $context,
 205                         list      => $list,
 206                         value     => $value,
 207                         order     => 18 + $index * 3,
 208                         newline_before => false,
 209                     }
 210                 }
 211             }
 212             concat::fragment { "sudo::defaults::${context} end":
 213                 target  => "sudoers_$default_target",
 214                 order   => 19 + $index * 3,
 215                 content => "# End sudo::defaults::${context} class parameters\n",
 216             }
 217         }
 218     }
 219 }
 220
 221 class sudo::internals {
 222
 223     define add_sudoers_fragment (
 224         String[1] $target,
 225         String[1] $content,
 226         Integer $order,
 227         Optional[String[1]] $comment = undef,
 228     ) {
 229         sudo::internals::ensure_sudoers_file { "${name}":
 230             target  => $target
 231         }
 232         $ts = strftime("%s.%N")
 233         # include the timestamp to preserve order in the output if execution
 234         # is ordered
 235         concat::fragment { "${ts}_sudoers_fragment_${target}_${name}":
 236             target  => "sudoers_file_${target}",
 237             content => $content,
 238             order   => $order,
 239         }
 240     }
 241     define ensure_sudoers_file(
 242         String[1] $target,
 243     ) {
 244         ensure_resource('concat', "sudoers_file_${target}", {
 245                 tag     => "${target}",
 246                 path    => "${sudo::include_directory}/$target",
 247                 warn    => "# THIS FILE IS MANAGED BY PUPPET; CHANGES WILL BE OVERWRITTEN\n",
 248                 require => File[$sudo::include_directory],
 249             } + $sudo::file_defaults,
 250         )
 251     }
 252 }