manifests/defaults.pp

   1 class sudo::defaults (
   2     Optional[String[1]] $sudogroup = undef,
   3     Boolean $root_may_sudo = true,
   4     Optional[Hash] $generic = undef,
   5     Optional[Hash] $user = undef,
   6     Optional[Hash] $host = undef,
   7     Optional[Hash] $runas = undef,
   8     Optional[Hash] $cmnd = undef,
   9 ) {
  10     $netfacts = $facts[networking] ? { undef => $facts, default => $facts[networking] }
  11     sudo::alias { "LOCALHOST":
  12         type => host,
  13         list => [ "localhost"
  14                 , $netfacts[hostname]
  15                 , $netfacts[fqdn]
  16                 ],
  17     }
  18
  19     if $sudogroup {
  20         $sudogroup_target = "00-sudogroup"
  21
  22         group { "$sudogroup":
  23             ensure => present,
  24             system => true
  25         }->
  26         sudo::rule { "sudogroup":
  27             who     => "%$sudogroup",
  28             where   => "LOCALHOST",
  29             require => Sudo::Alias["LOCALHOST"],
  30             what    => "PASSWD: ALL",
  31             target  => "$sudogroup_target",
  32             comment => "Members of the ${sudogroup} group can use sudo (with password)",
  33         }
  34     }
  35
  36     if $root_may_sudo {
  37         $rootsudo_target = "00-root_may_sudo"
  38
  39         sudo::option { "syslog":
  40             value   => false,
  41             context => user,
  42             list    => "root",
  43             target  => "$rootsudo_target",
  44             comment => "No need to log root usage of sudo",
  45         }->
  46         sudo::rule { "root_may_sudo":
  47             who     => "root",
  48             where   => "LOCALHOST",
  49             require => Sudo::Alias["LOCALHOST"],
  50             what    => "NOPASSWD: ALL",
  51             target  => "$rootsudo_target",
  52             comment => "root may inadvertedly run sudo, so let them:",
  53         }
  54     }
  55
  56     if $generic {
  57         concat::fragment { "sudo::defaults::generic comment":
  58             target  => "sudoers_file_$sudo::default_target",
  59             order   => 14,
  60             content => "\n# Generated from the sudo::defaults::generic class parameter:\n",
  61         }
  62         $generic.each | $param, $value | {
  63             sudo::option { "$param":
  64                 value    => $value,
  65                 order    => 15,
  66                 newline_before => false,
  67                 require  => Concat::Fragment["sudo::defaults::generic comment"],
  68             }
  69         }
  70         concat::fragment { "sudo::defaults::generic end":
  71             target  => "sudoers_file_$sudo::default_target",
  72             order   => 16,
  73             content => "# End sudo::defaults::generic class parameters\n",
  74         }
  75     }
  76
  77     $context_hash = {"user"=>$user,"host"=>$host,"runas"=>$runas,"cmnd"=>$cmnd}
  78     $context_hash.keys.each | $index, $context | {
  79         $defaults = $context_hash[$context]
  80         if $defaults {
  81             concat::fragment { "sudo::defaults::${context} comment":
  82                 target  => "sudoers_$default_target",
  83                 order   => 17 + $index * 3,
  84                 content => "\n# Generated from the sudo::defaults::${context} class parameter:\n",
  85             }
  86             $defaults.each | $list, $items  | {
  87                 $items.each | $param, $value | {
  88                     sudo::option { "${context}_${list}_${param}":
  89                         parameter => $param,
  90                         context   => $context,
  91                         list      => $list,
  92                         value     => $value,
  93                         order     => 18 + $index * 3,
  94                         newline_before => false,
  95                     }
  96                 }
  97             }
  98             concat::fragment { "sudo::defaults::${context} end":
  99                 target  => "sudoers_$default_target",
 100                 order   => 19 + $index * 3,
 101                 content => "# End sudo::defaults::${context} class parameters\n",
 102             }
 103         }
 104     }
 105 }