REFERENCE.md

Reference

Table of Contents

Classes

• sudo: Constructs a sudoers file based on configured aliases, defaults, and user specifications.

Defined types

• sudo::alias: Adds an alias to /etc/sudoers. See the 'Aliases' section of sudoers (5) for information about aliases Use the alias definition: alias
• sudo::alias::cmnd: Convenience definition for adding a cmnd alias.
• sudo::alias::host: Convenience definition for adding a host alias.
• sudo::alias::runas: Convenience definition for adding a runas alias.
• sudo::alias::user: Convenience definition for adding a user alias.
• sudo::default_entry: Adds an entry to the defaults section of /etc/sudoers in order to override runtime defaults. See the 'Defaults' section of sudoers(5) for mor
• sudo::include_dir: Add include directories to /etc/sudoers
• sudo::user_specification: Add a user_spec entry to /etc/sudoers in order to determine which commands a user may run as the given user on the given host. See the 'User

Functions

• sudo::update_runas_list: This function is used to help mitigate CVE-2019-14287 for sudo version prior to 1.8.28. It will disallow userid/groupid of -1 if ALL or %A

Data types

• Sudo::AliasType: Matches the list of configuration items for which aliases can be set in the sudeors file.
• Sudo::DefType: Matches the list configuration items for which defaults can be set in the sudoers file.

Classes

sudo

Constructs a sudoers file based on configured aliases, defaults, and user specifications.

Parameters

The following parameters are available in the sudo class:

• user_specifications
• include_dirs
• package_ensure
• default_entries
• aliases

user_specifications

Data type: Hash

A hash of sudo::user_specification resources that can be set in hiera Example:

sudo::user_specifications: simp_su: user_list: ['simp'] cmnd: ['/bin/su'] users_yum_update: user_list: - '%users' cmnd: - 'yum update' test_resource: user_list: ['%group'] cmnd: ['w'] runas: root passwd: true

Default value: {}

include_dirs

Data type: Array[Stdlib::Absolutepath]

an array of paths to include in the sudoers file

Default value: []

package_ensure

Data type: String

The ensure status of packages to be managed

Default value: simplib::lookup('simp_options::package_ensure', { 'default_value' => 'installed' })

default_entries

Data type: Hash

Default value: {}

aliases

Data type: Hash

Default value: {}

Defined types

sudo::alias

Adds an alias to /etc/sudoers. See the 'Aliases' section of sudoers (5) for information about aliases

Use the alias definition: alias { 'user_alias': content => [ 'millert','mikef','dowdy' ], alias_type => 'user' }

Examples

To create the following alias in sudoers:

User_Alias FULLTIMERS = millert, mikef, dowdy

Parameters

The following parameters are available in the sudo::alias defined type:

• content
• alias_type
• comment
• order

content

Data type: Array[String[1]]

The array of items that will be the content of this alias. For example: 'administrators', 'wheel'

alias_type

Data type: Sudo::AliasType

The type of alias to create. One of 'user', 'runas', 'host' or 'cmnd'

comment

Data type: Optional[String[1]]

Textual comment for this entry

Default value: undef

order

Data type: Integer

If desired, force the order of this entry relative to other entries. Usually not required.

Default value: 10

sudo::alias::cmnd

Convenience definition for adding a cmnd alias.

Parameters

The following parameters are available in the sudo::alias::cmnd defined type:

• content
• comment
• order

content

Data type: Array[String[1]]

A comma-separated list of commands that will comprise this alias. For example: ['/usr/sbin/shutdown', '/usr/sbin/reboot']

comment

Data type: Optional[String[1]]

Textual comment for this entry.

Default value: undef

order

Data type: Integer

If desired, force the order of this entry relative to other entries. Usually not required.

Default value: 10

sudo::alias::host

Convenience definition for adding a host alias.

Parameters

The following parameters are available in the sudo::alias::host defined type:

• content
• comment
• order

content

Data type: Array[String[1]]

A comma-separated list of hostnames or IP addresses that will comprise the alias. For example: ['1.2.3.4', '5.6.7.8'] or ['mail', 'www']

comment

Data type: Optional[String[1]]

Textual comment for this entry

Default value: undef

order

Data type: Integer

If desired, force the order of this entry relative to other entries. Usually not required.

Default value: 12

sudo::alias::runas

Convenience definition for adding a runas alias.

Parameters

The following parameters are available in the sudo::alias::runas defined type:

• content
• comment
• order

content

Data type: Array[String[1]]

A comma-separated list of hostnames or IP addresses that will comprise the alias. For example: ['millert', 'mikef']

comment

Data type: Optional[String[1]]

Textual comment for this entry

Default value: undef

order

Data type: Integer

If desired, force the order of this entry relative to other entries. Usually not required.

Default value: 14

sudo::alias::user

Convenience definition for adding a user alias.

Parameters

The following parameters are available in the sudo::alias::user defined type:

• content
• comment
• order

content

Data type: Array[String[1]]

A comma-separated list of users that will comprise this alias. For example: ['millert', 'mikef']

comment

Data type: Optional[String[1]]

Textual comment for this entry

Default value: undef

order

Data type: Integer

If desired, force the order of this entry relative to other entries. Usually not required.

Default value: 16

sudo::default_entry

Adds an entry to the defaults section of /etc/sudoers in order to override runtime defaults. See the 'Defaults' section of sudoers(5) for more information.

Examples

To create the following defaults line in sudoers:

Defaults    requiretty, syslog=authpriv, !root_sudo, !umask, env_reset, env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR \
                     LS_COLORS MAIL PS1 PS2 QTDIR USERNAME \
                     LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION \
                     LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC \
                     LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS \
                     _XKB_CHARSET XAUTHORITY"

Use the default_entry definition:
  sudo::default_entry { '00_main':
      content => [ 'requiretty',
          'syslog=authpriv',
          '!root_sudo',
          '!umask',
          'env_reset',
          'env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR \
                       LS_COLORS MAIL PS1 PS2 QTDIR USERNAME \
                       LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION \
                       LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC \
                       LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS \
                       _XKB_CHARSET XAUTHORITY"' ]
  }

Parameters

The following parameters are available in the sudo::default_entry defined type:

• content
• target
• def_type

content

Data type: Array[String[1]]

The content of this entry.

target

Data type: Optional[String[1]]

The user, host, etc hash is the target of the content. Leave as undef to not specify a target.

Default value: undef

def_type

Data type: Sudo::DefType

May be one of:

• base => Global
• cmnd => Cmnd Entry
• host => Host Entry
• user => User Entry
• runas => Runas Entry

Default value: 'base'

sudo::include_dir

Add include directories to /etc/sudoers

Parameters

The following parameters are available in the sudo::include_dir defined type:

• include_dir
• tidy_include_dir

include_dir

Data type: Stdlib::Absolutepath

the directory to include in /etc/sudoers

tidy_include_dir

Data type: Boolean

Default value: false

sudo::user_specification

Add a user_spec entry to /etc/sudoers in order to determine which commands a user may run as the given user on the given host. See the 'User Specification' section of sudoers(5) for more information. Note that the 'Tag_Spec' entries have been explicitly noted below.

Examples

To create the following in /etc/sudoers:

`simp, %simp_group    user2-dev1=(root) PASSWD:EXEC:SETENV: /bin/su root, /bin/su - root`
Use the user_specification definition:
  sudo::user_specification { 'default_simp':
    user_list => [ 'simp', '%simp_group' ],
    runas     => 'root',
    cmnd      => [ '/bin/su root', '/bin/su - root' ]
  }

Parameters

The following parameters are available in the sudo::user_specification defined type:

• user_list
• cmnd
• host_list
• runas
• passwd
• doexec
• setenv
• options

user_list

Data type: Array[String[1]]

Array of users or groups that should be able to execute a command. Groups must be preceded by %.

cmnd

Data type: Array[String[1]]

Should be an array of commands you wan to run.

host_list

Data type: Array[Simplib::Hostname,1]

Array of hosts where the specified users should be able to execute a command.

Default value: [$facts['networking']['hostname'], $facts['networking']['fqdn']]

runas

Data type: Variant[String[1],Array[String[1]]]

Can be an array of users that you need to be able to run the commands as. It will probably just be one user in most cases.

Default value: ['root']

passwd

Data type: Boolean

Set PASSWD in /etc/sudoers

Default value: true

doexec

Data type: Boolean

Set EXEC in /etc/sudoers

Default value: true

setenv

Data type: Boolean

Set SETENV in /etc/sudoers

Default value: true

options

Data type: Hash

Set additional options (such as SELinux role or type, date restrictions, or timeout)

Default value: {}

Functions

sudo::update_runas_list

Type: Ruby 4.x API

This function is used to help mitigate CVE-2019-14287 for sudo version prior to 1.8.28. It will disallow userid/groupid of -1 if ALL or %ALL is used.

sudo::update_runas_list(Array[String] $content)

Note: Added even if !root is not present because it will skip over some auditing if #-1 is used.

Returns: Array[String] An Array of users to add to a Runas_list in sudo that appends not -1 if 'ALL' or '%ALL' are used to avoid giving unintentional root access or skip auditing.

content

Data type: Array[String]

An array of users/groups to add to a Runas_list in sudo

sudo::update_runas_list(String $content)

Note: Added even if !root is not present because it will skip over some auditing if #-1 is used.

Returns: Array[String] An Array of users to add to a Runas_list in sudo that appends not -1 if 'ALL' or '%ALL' are used to avoid giving unintentional root access or skip auditing.

content

Data type: String

A string of one user/group id to to Runas_list.

Data types

Sudo::AliasType

Matches the list of configuration items for which aliases can be set in the sudeors file.

Alias of Enum['user', 'runas', 'host', 'cmnd']

Sudo::DefType

Matches the list configuration items for which defaults can be set in the sudoers file.

Alias of Enum['base', 'cmnd', 'host', 'user', 'runas']