Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ipa sudorule/add deny options #7415

Merged
merged 6 commits into from
Nov 15, 2023
Merged

Ipa sudorule/add deny options #7415

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b8d1a46
Introduce options to include 'deny' commands and command groups
Oct 20, 2023
327b72c
Adding Changelog fragment
Oct 20, 2023
e445c81
Apply suggestions from code review
risadams Oct 31, 2023
c04e1d6
Update changelogs/fragments/add-ipa-sudorule-deny-cmd.yml
risadams Oct 31, 2023
7bc0bdd
Update plugins/modules/ipa_sudorule.py
risadams Nov 4, 2023
c94ba3f
Update plugins/modules/ipa_sudorule.py
risadams Nov 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions changelogs/fragments/add-ipa-sudorule-deny-cmd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
minor_changes:
- ipa_sudorule - adds options to include denied commands or command groups (https://github.com/ansible-collections/community.general/pull/7415).
38 changes: 38 additions & 0 deletions plugins/modules/ipa_sudorule.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,22 @@
type: list
elements: str
version_added: 2.0.0
deny_cmd:
description:
- List of denied commands assigned to the rule.
- If an empty list is passed all commands will be removed from the rule.
- If option is omitted commands will not be checked or changed.
type: list
elements: str
risadams marked this conversation as resolved.
Show resolved Hide resolved
version_added: 8.1.0
deny_cmdgroup:
description:
- List of denied command groups assigned to the rule.
- If an empty list is passed all command groups will be removed from the rule.
- If option is omitted command groups will not be checked or changed.
type: list
elements: str
risadams marked this conversation as resolved.
Show resolved Hide resolved
version_added: 8.1.0
description:
description:
- Description of the sudo rule.
Expand Down Expand Up @@ -246,6 +262,12 @@ def sudorule_add_allow_command(self, name, item):
def sudorule_add_allow_command_group(self, name, item):
return self._post_json(method='sudorule_add_allow_command', name=name, item={'sudocmdgroup': item})

def sudorule_add_deny_command(self, name, item):
return self._post_json(method='sudorule_add_deny_command', name=name, item={'sudocmd': item})

def sudorule_add_deny_command_group(self, name, item):
return self._post_json(method='sudorule_add_deny_command', name=name, item={'sudocmdgroup': item})

def sudorule_remove_allow_command(self, name, item):
return self._post_json(method='sudorule_remove_allow_command', name=name, item=item)

Expand Down Expand Up @@ -303,6 +325,8 @@ def ensure(module, client):
cmd = module.params['cmd']
cmdgroup = module.params['cmdgroup']
cmdcategory = module.params['cmdcategory']
deny_cmd = module.params['deny_cmd']
deny_cmdgroup = module.params['deny_cmdgroup']
host = module.params['host']
hostcategory = module.params['hostcategory']
hostgroup = module.params['hostgroup']
Expand Down Expand Up @@ -359,6 +383,16 @@ def ensure(module, client):
if not module.check_mode:
client.sudorule_add_allow_command_group(name=name, item=cmdgroup)

if deny_cmd is not None:
changed = category_changed(module, client, 'cmdcategory', ipa_sudorule) or changed
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure, but how does category_changed with these parameters determines whether there will be an actual change for deny_cmd?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This may be naive on my part, but I was following the same pattern for dney_cmd as was already in place for cmd

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure what exactly is the code doing there either. It might be broken there as well. But I don't really know how IPA works so...

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess the main question is: does this work as expected? I.e. are deny_cmd and deny_cmdgroup updated if different values are applied, and is the changed return value correct (i.e. changed=true only if the value changed)?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it's been operating correctly on my tests.

if not module.check_mode:
client.sudorule_add_deny_command(name=name, item=deny_cmd)

if deny_cmdgroup is not None:
changed = category_changed(module, client, 'cmdcategory', ipa_sudorule) or changed
if not module.check_mode:
client.sudorule_add_deny_command_group(name=name, item=deny_cmdgroup)

if runasusercategory is not None:
changed = category_changed(module, client, 'iparunasusercategory', ipa_sudorule) or changed

Expand Down Expand Up @@ -433,6 +467,8 @@ def main():
cmdgroup=dict(type='list', elements='str'),
cmdcategory=dict(type='str', choices=['all']),
cn=dict(type='str', required=True, aliases=['name']),
deny_cmd=dict(type='list', elements='str'),
deny_cmdgroup=dict(type='list', elements='str'),
description=dict(type='str'),
host=dict(type='list', elements='str'),
hostcategory=dict(type='str', choices=['all']),
Expand All @@ -447,7 +483,9 @@ def main():
runasextusers=dict(type='list', elements='str'))
module = AnsibleModule(argument_spec=argument_spec,
mutually_exclusive=[['cmdcategory', 'cmd'],
['cmdcategory', 'deny_cmd'],
['cmdcategory', 'cmdgroup'],
['cmdcategory', 'deny_cmdgroup'],
['hostcategory', 'host'],
['hostcategory', 'hostgroup'],
['usercategory', 'user'],
Expand Down