Ipa sudorule/add deny options #7415

risadams · 2023-10-20T13:22:32Z

SUMMARY

Introduces new options for deny_cmd and deny_cmdgroup to the ipa_sudorule module.
This allows the user to specify options to allow commands to be added to the 'disallow' section of a sudorule

ISSUE TYPE

Feature Pull Request

COMPONENT NAME

ipa_sudorule

ADDITIONAL INFORMATION

ansibullbot · 2023-10-20T13:30:10Z

cc @Akasurde @Nosmoht @fxfitz @justchris1
click here for bot help

felixfontein

Thanks for your contribution!

changelogs/fragments/add-ipa-sudorule-deny-cmd.yml

plugins/modules/ipa_sudorule.py

felixfontein · 2023-10-30T22:07:29Z

plugins/modules/ipa_sudorule.py

@@ -359,6 +381,16 @@ def ensure(module, client):
 if not module.check_mode:
 client.sudorule_add_allow_command_group(name=name, item=cmdgroup)

+ if deny_cmd is not None:
+ changed = category_changed(module, client, 'cmdcategory', ipa_sudorule) or changed


I'm not sure, but how does category_changed with these parameters determines whether there will be an actual change for deny_cmd?

This may be naive on my part, but I was following the same pattern for dney_cmd as was already in place for cmd

I'm not sure what exactly is the code doing there either. It might be broken there as well. But I don't really know how IPA works so...

I guess the main question is: does this work as expected? I.e. are deny_cmd and deny_cmdgroup updated if different values are applied, and is the changed return value correct (i.e. changed=true only if the value changed)?

Yes, it's been operating correctly on my tests.

Co-authored-by: Felix Fontein <felix@fontein.de>

plugins/modules/ipa_sudorule.py

Co-authored-by: Felix Fontein <felix@fontein.de>

felixfontein · 2023-11-09T21:21:29Z

If nobody objects, I'll merge this in ~a week.

patchback · 2023-11-15T21:01:11Z

Backport to stable-8: 💚 backport PR created

✅ Backport PR branch: patchback/backports/stable-8/df66885fa4827d5692558fb011d7b11e00fe2209/pr-7415

Backported as #7526

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

felixfontein · 2023-11-15T21:01:16Z

@risadams thanks for your contribution!

* Introduce options to include 'deny' commands and command groups * Adding Changelog fragment * Apply suggestions from code review Co-authored-by: Felix Fontein <felix@fontein.de> * Update changelogs/fragments/add-ipa-sudorule-deny-cmd.yml Co-authored-by: Felix Fontein <felix@fontein.de> * Update plugins/modules/ipa_sudorule.py Co-authored-by: Felix Fontein <felix@fontein.de> * Update plugins/modules/ipa_sudorule.py Co-authored-by: Felix Fontein <felix@fontein.de> --------- Co-authored-by: Ris Adams <ris@risadams.com> Co-authored-by: Felix Fontein <felix@fontein.de> (cherry picked from commit df66885)

…7526) Ipa sudorule/add deny options (#7415) * Introduce options to include 'deny' commands and command groups * Adding Changelog fragment * Apply suggestions from code review Co-authored-by: Felix Fontein <felix@fontein.de> * Update changelogs/fragments/add-ipa-sudorule-deny-cmd.yml Co-authored-by: Felix Fontein <felix@fontein.de> * Update plugins/modules/ipa_sudorule.py Co-authored-by: Felix Fontein <felix@fontein.de> * Update plugins/modules/ipa_sudorule.py Co-authored-by: Felix Fontein <felix@fontein.de> --------- Co-authored-by: Ris Adams <ris@risadams.com> Co-authored-by: Felix Fontein <felix@fontein.de> (cherry picked from commit df66885) Co-authored-by: Ris Adams <5329119+risadams@users.noreply.github.com>

…category

v9.1.0 ansible.utils ~~~~~~~~~~~~~ - Fact_diff filter plugin - Add fact_diff filter plugin. (ansible-collections/ansible.utils#78). ansible.windows ~~~~~~~~~~~~~~~ - Set minimum supported Ansible version to 2.14 to align with the versions still supported by Ansible. - win_share - Added a new param called ``scope_name`` that allows file shares to be scoped for Windows Server failover cluster roles. cisco.ios ~~~~~~~~~ - Added ios_evpn_evi resource module. - Added ios_evpn_global resource module. - Added ios_vxlan_vtep resource module. - Fixed ios_evpn_evi resource module integration test failure - code to remove VLAN config. - ios_bgp_address_family - Fixed an issue with inherit peer-policy CLI - ios_bgp_address_family - added 'advertise' key - ios_vlans - added vlan config CLI feature. - ios_vrf - added MDT related keys cisco.ise ~~~~~~~~~ - Services included configuration, edda, dataconnect_services, subscriber. cisco.nxos ~~~~~~~~~~ - nxos_config - Relax restrictions on I(src) parameter so it can be used more like I(lines). (ansible-collections/cisco.nxos#89). community.general ~~~~~~~~~~~~~~~~~ - bitwarden lookup plugin - when looking for items using an item ID, the item is now accessed directly with ``bw get item`` instead of searching through all items. This doubles the lookup speed (ansible-collections/community.general#7468). - elastic callback plugin - close elastic client to not leak resources (ansible-collections/community.general#7517). - git_config - allow multiple git configs for the same name with the new ``add_mode`` option (ansible-collections/community.general#7260). - git_config - the ``after`` and ``before`` fields in the ``diff`` of the return value can be a list instead of a string in case more configs with the same key are affected (ansible-collections/community.general#7260). - git_config - when a value is unset, all configs with the same key are unset (ansible-collections/community.general#7260). - gitlab modules - add ``ca_path`` option (ansible-collections/community.general#7472). - gitlab modules - remove duplicate ``gitlab`` package check (ansible-collections/community.general#7486). - gitlab_runner - add support for new runner creation workflow (ansible-collections/community.general#7199). - ipa_config - adds ``passkey`` choice to ``ipauserauthtype`` parameter's choices (ansible-collections/community.general#7588). - ipa_sudorule - adds options to include denied commands or command groups (ansible-collections/community.general#7415). - ipa_user - adds ``idp`` and ``passkey`` choice to ``ipauserauthtype`` parameter's choices (ansible-collections/community.general#7589). - irc - add ``validate_certs`` option, and rename ``use_ssl`` to ``use_tls``, while keeping ``use_ssl`` as an alias. The default value for ``validate_certs`` is ``false`` for backwards compatibility. We recommend to every user of this module to explicitly set ``use_tls=true`` and `validate_certs=true`` whenever possible, especially when communicating to IRC servers over the internet (ansible-collections/community.general#7550). - keycloak module utils - expose error message from Keycloak server for HTTP errors in some specific situations (ansible-collections/community.general#7645). - keycloak_user_federation - add option for ``krbPrincipalAttribute`` (ansible-collections/community.general#7538). - lvol - change ``pvs`` argument type to list of strings (ansible-collections/community.general#7676, ansible-collections/community.general#7504). - lxd connection plugin - tighten the detection logic for lxd ``Instance not found`` errors, to avoid false detection on unrelated errors such as ``/usr/bin/python3: not found`` (ansible-collections/community.general#7521). - netcup_dns - adds support for record types ``OPENPGPKEY``, ``SMIMEA``, and ``SSHFP`` (ansible-collections/community.general#7489). - nmcli - add support for new connection type ``loopback`` (ansible-collections/community.general#6572). - nmcli - allow for ``infiniband`` slaves of ``bond`` interface types (ansible-collections/community.general#7569). - nmcli - allow for the setting of ``MTU`` for ``infiniband`` and ``bond`` interface types (ansible-collections/community.general#7499). - onepassword lookup plugin - support 1Password Connect with the opv2 client by setting the connect_host and connect_token parameters (ansible-collections/community.general#7116). - onepassword_raw lookup plugin - support 1Password Connect with the opv2 client by setting the connect_host and connect_token parameters (ansible-collections/community.general#7116) - passwordstore - adds ``timestamp`` and ``preserve`` parameters to modify the stored password format (ansible-collections/community.general#7426). - proxmox - adds ``template`` value to the ``state`` parameter, allowing conversion of container to a template (ansible-collections/community.general#7143). - proxmox - adds ``update`` parameter, allowing update of an already existing containers configuration (ansible-collections/community.general#7540). - proxmox inventory plugin - adds an option to exclude nodes from the dynamic inventory generation. The new setting is optional, not using this option will behave as usual (ansible-collections/community.general#6714, ansible-collections/community.general#7461). - proxmox_disk - add ability to manipulate CD-ROM drive (ansible-collections/community.general#7495). - proxmox_kvm - adds ``template`` value to the ``state`` parameter, allowing conversion of a VM to a template (ansible-collections/community.general#7143). - proxmox_kvm - support the ``hookscript`` parameter (ansible-collections/community.general#7600). - proxmox_ostype - it is now possible to specify the ``ostype`` when creating an LXC container (ansible-collections/community.general#7462). - proxmox_vm_info - add ability to retrieve configuration info (ansible-collections/community.general#7485). - redfish_info - adding the ``BootProgress`` property when getting ``Systems`` info (ansible-collections/community.general#7626). - ssh_config - adds ``controlmaster``, ``controlpath`` and ``controlpersist`` parameters (ansible-collections/community.general#7456). community.routeros ~~~~~~~~~~~~~~~~~~ - api_info, api_modify - add missing DoH parameters ``doh-max-concurrent-queries``, ``doh-max-server-connections``, and ``doh-timeout`` to the ``ip dns`` path (ansible-collections/community.routeros#230, ansible-collections/community.routeros#235) - api_info, api_modify - add missing parameters ``address-list``, ``address-list-timeout``, ``randomise-ports``, and ``realm`` to subpaths of the ``ip firewall`` path (ansible-collections/community.routeros#236, ansible-collections/community.routeros#237). - api_info, api_modify - mark the ``interface wireless`` parameter ``running`` as read-only (ansible-collections/community.routeros#233). - api_info, api_modify - set the default value to ``false`` for the ``disabled`` parameter in some more paths where it can be seen in the documentation (ansible-collections/community.routeros#237). - api_modify - add missing ``comment`` attribute to ``/routing id`` (ansible-collections/community.routeros#234). - api_modify - add missing attributes to the ``routing bgp connection`` path (ansible-collections/community.routeros#234). - api_modify - add versioning to the ``/tool e-mail`` path (RouterOS 7.12 release) (ansible-collections/community.routeros#234). - api_modify - make ``/ip traffic-flow target`` a multiple value attribute (ansible-collections/community.routeros#234). community.windows ~~~~~~~~~~~~~~~~~ - Set minimum supported Ansible version to 2.14 to align with the versions still supported by Ansible. community.zabbix ~~~~~~~~~~~~~~~~ - Added zabbix_group_events_info module - action module - Added notify_if_canceled property - agent and proxy roles - Set default `zabbix_api_server_port` to 80 or 443 based on `zabbix_api_use_ssl` - agent role - Removed duplicative Windows agent task - agent role - Standardized default yum priority to 99 - all roles - Re-added ability to override Debian repo source - all roles - Updated Debian repository format to 822 standard - various - updated testing modules - various - updated to fully qualified module names - zabbix agent - Added capability to add additional configuration includes - zabbix_api_info module added - zabbix_user module - add current_passwd optional parameter to enable password updating of the currently logged in user (https://www.zabbix.com/documentation/6.4/en/manual/api/reference/user/update) dellemc.powerflex ~~~~~~~~~~~~~~~~~ - Added support for PowerFlex Denver version(4.5.x) to TB and Config role. f5networks.f5_modules ~~~~~~~~~~~~~~~~~~~~~ - bigiq_device_discovery - Changes in documentation related to Provider block google.cloud ~~~~~~~~~~~~ - anisble-test - integration tests are now run against 2.14.0 and 2.15.0 - ansible - 2.14.0 is now the minimum version supported - ansible-lint - fixed over a thousand reported errors - ansible-lint - upgraded to 6.22 - ansible-test - add support for GCP application default credentials (ansible-collections/google.cloud#359). - gcp_serviceusage_service - added backoff when checking for operation completion. - gcp_serviceusage_service - use alloyb API for the integration test as spanner conflicts with other tests - gcp_sql_ssl_cert - made sha1_fingerprint optional, which enables resource creation - gcp_storage_default_object_acl - removed non-existent fields; the resource is not usable. hetzner.hcloud ~~~~~~~~~~~~~~ - Add the `hetzner.hcloud.all` group to configure all the modules using `module_defaults`. - Allow to set the `api_endpoint` module argument using the `HCLOUD_ENDPOINT` environment variable. - Removed the `hcloud_` prefix from all modules names, e.g. `hetzner.hcloud.hcloud_firewall` was renamed to `hetzner.hcloud.firewall`. Old module names will continue working. - Renamed the `endpoint` module argument to `api_endpoint`, backward compatibility is maintained using an alias. - hcloud inventory - Add the `api_endpoint` option. - hcloud inventory - Deprecate the `api_token_env` option, suggest using a lookup plugin (`{{ lookup('ansible.builtin.env', 'YOUR_ENV_VAR') }}`) or use the well-known `HCLOUD_TOKEN` environment variable name. - hcloud inventory - Rename the `token_env` option to `api_token_env`, use aliases for backward compatibility. - hcloud inventory - Rename the `token` option to `api_token`, use aliases for backward compatibility. inspur.ispim ~~~~~~~~~~~~ - Modify edit_smtp_com and add description information. microsoft.ad ~~~~~~~~~~~~ - Make ``name`` an optional parameter for the AD modules. Either ``name`` or ``identity`` needs to be set with their respective behaviours. If creating a new AD user and only ``identity`` is set, that will be the value used for the name of the object. - Set minimum supported Ansible version to 2.14 to align with the versions still supported by Ansible. - object_info - Add ActiveDirectory module import purestorage.flasharray ~~~~~~~~~~~~~~~~~~~~~~ - purefa_dns - Added facility to add a CA certifcate to management DNS and check peer. - purefa_info - Add NSID value for NVMe namespace in `hosts` response - purefa_info - Subset `pgroups` now also provides a new dict called `deleted_pgroups` - purefa_offload - Remove `nfs` as an option when Purity//FA 6.6.0 or higher is detected - purefa_snap - Add support for suffix on remote offload snapshots telekom_mms.icinga_director ~~~~~~~~~~~~~~~~~~~~~~~~~~~ - Extended docs and examples for multiple assign_filter conditions (telekom-mms/ansible-collection-icinga-director#227) theforeman.foreman ~~~~~~~~~~~~~~~~~~ - content_view_publish role - allow passing ``async`` and ``poll`` to the module (theforeman/foreman-ansible-modules#1676) - convert2rhel role - install ``convert2rhel`` from ``cdn-public.redhat.com``, dropping the requirement of a custom CA cert

Ris Adams added 2 commits October 20, 2023 09:05

Introduce options to include 'deny' commands and command groups

b8d1a46

Adding Changelog fragment

327b72c

ansibullbot added feature This issue/PR relates to a feature request module module new_contributor Help guide this first time contributor plugins plugin (any type) labels Oct 20, 2023

felixfontein added the check-before-release PR will be looked at again shortly before release and merged if possible. label Oct 20, 2023

ansibullbot added the stale_ci CI is older than 7 days, rerun before merging label Oct 28, 2023

felixfontein reviewed Oct 30, 2023

View reviewed changes

risadams and others added 2 commits October 31, 2023 08:34

Apply suggestions from code review

e445c81

Co-authored-by: Felix Fontein <felix@fontein.de>

Update changelogs/fragments/add-ipa-sudorule-deny-cmd.yml

c04e1d6

Co-authored-by: Felix Fontein <felix@fontein.de>

ansibullbot removed the stale_ci CI is older than 7 days, rerun before merging label Oct 31, 2023

felixfontein added the backport-8 Automatically create a backport for the stable-8 branch label Nov 1, 2023

felixfontein reviewed Nov 1, 2023

View reviewed changes

plugins/modules/ipa_sudorule.py Outdated Show resolved Hide resolved

plugins/modules/ipa_sudorule.py Outdated Show resolved Hide resolved

risadams and others added 2 commits November 4, 2023 17:08

Update plugins/modules/ipa_sudorule.py

7bc0bdd

Co-authored-by: Felix Fontein <felix@fontein.de>

Update plugins/modules/ipa_sudorule.py

c94ba3f

Co-authored-by: Felix Fontein <felix@fontein.de>

felixfontein removed the check-before-release PR will be looked at again shortly before release and merged if possible. label Nov 15, 2023

felixfontein merged commit df66885 into ansible-collections:main Nov 15, 2023
119 checks passed

patchback bot mentioned this pull request Nov 15, 2023

[PR #7415/df66885f backport][stable-8] Ipa sudorule/add deny options #7526

Merged

risadams deleted the ipa-sudorule/add-deny-options branch November 15, 2023 21:19

risadams mentioned this pull request Dec 6, 2023

IPA sudo rules cannot create body deny command and command category in the same rule #7692

Open

1 task

risadams added a commit to risadams/community.general that referenced this pull request Dec 6, 2023

Fix for ansible-collections#7415, ipa sudo rule deny command with cmd…

25b7542

…category

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Ipa sudorule/add deny options #7415

Ipa sudorule/add deny options #7415

risadams commented Oct 20, 2023

ansibullbot commented Oct 20, 2023

felixfontein left a comment

felixfontein Oct 30, 2023

risadams Oct 31, 2023

felixfontein Nov 1, 2023

felixfontein Nov 5, 2023

risadams Nov 6, 2023

felixfontein commented Nov 9, 2023

patchback bot commented Nov 15, 2023 •

edited

Loading

felixfontein commented Nov 15, 2023

Ipa sudorule/add deny options #7415

Ipa sudorule/add deny options #7415

Conversation

risadams commented Oct 20, 2023

SUMMARY

ISSUE TYPE

COMPONENT NAME

ADDITIONAL INFORMATION

ansibullbot commented Oct 20, 2023

felixfontein left a comment

Choose a reason for hiding this comment

felixfontein Oct 30, 2023

Choose a reason for hiding this comment

risadams Oct 31, 2023

Choose a reason for hiding this comment

felixfontein Nov 1, 2023

Choose a reason for hiding this comment

felixfontein Nov 5, 2023

Choose a reason for hiding this comment

risadams Nov 6, 2023

Choose a reason for hiding this comment

felixfontein commented Nov 9, 2023

patchback bot commented Nov 15, 2023 • edited Loading

Backport to stable-8: 💚 backport PR created

felixfontein commented Nov 15, 2023

patchback bot commented Nov 15, 2023 •

edited

Loading