diff --git a/Rakefile b/Rakefile index 5c10c3f..dc3ab55 100644 --- a/Rakefile +++ b/Rakefile @@ -1,42 +1,43 @@ require 'puppetlabs_spec_helper/rake_tasks' require 'puppet_blacksmith/rake_tasks' require 'voxpupuli/release/rake_tasks' if RUBY_VERSION >= '2.2.0' require 'rubocop/rake_task' RuboCop::RakeTask.new(:rubocop) do |task| # These make the rubocop experience maybe slightly less terrible task.options = ['-D', '-S', '-E'] end end PuppetLint.configuration.fail_on_warnings = true +PuppetLint.configuration.absolute_classname_reverse = true PuppetLint.configuration.send('relative') PuppetLint.configuration.send('disable_140chars') PuppetLint.configuration.send('disable_class_inherits_from_params_class') PuppetLint.configuration.send('disable_documentation') PuppetLint.configuration.send('disable_single_quote_string_with_variables') exclude_paths = %w( pkg/**/* vendor/**/* .vendor/**/* spec/**/* ) PuppetLint.configuration.ignore_paths = exclude_paths PuppetSyntax.exclude_paths = exclude_paths desc 'Run acceptance tests' RSpec::Core::RakeTask.new(:acceptance) do |t| t.pattern = 'spec/acceptance' end desc 'Run tests metadata_lint, lint, syntax, spec' task test: [ :metadata_lint, :lint, :syntax, :spec, ] # vim: syntax=ruby diff --git a/manifests/conf.pp b/manifests/conf.pp index 5f7de97..7f0154d 100644 --- a/manifests/conf.pp +++ b/manifests/conf.pp @@ -1,138 +1,137 @@ # Define: sudo::conf # # This module manages sudo configurations # # Parameters: # [*ensure*] # Ensure if present or absent. # Default: present # # [*priority*] # Prefix file name with $priority # Default: 10 # # [*content*] # Content of configuration snippet. # Default: undef # # [*source*] # Source of configuration snippet. # Default: undef # # [*sudo_config_dir*] # Where to place configuration snippets. # Only set this, if your platform is not supported or # you know, what you're doing. # Default: auto-set, platform specific # # Actions: # Installs sudo configuration snippets # # Requires: # Class sudo # # Sample Usage: # sudo::conf { 'admins': # source => 'puppet:///files/etc/sudoers.d/admins', # } # # [Remember: No empty lines between comments and class definition] define sudo::conf( $ensure = present, $priority = 10, $content = undef, $source = undef, $template = undef, $sudo_config_dir = undef, $sudo_file_name = undef, $sudo_syntax_path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' - ) { - - include ::sudo +) { + include sudo # Hack to allow the user to set the config_dir from the # sudo::config parameter, but default to $sudo::params::config_dir # if it is not provided. $sudo::params isn't included before # the parameters are loaded in. $sudo_config_dir_real = $sudo_config_dir ? { undef => $sudo::config_dir, $sudo_config_dir => $sudo_config_dir } # sudo skip file name that contain a "." $dname = regsubst($name, '\.', '-', 'G') if size("x${priority}") == 2 { $priority_real = "0${priority}" } else { $priority_real = $priority } # build current file name with path if $sudo_file_name != undef { $cur_file = "${sudo_config_dir_real}/${sudo_file_name}" } else { $cur_file = "${sudo_config_dir_real}/${priority_real}_${dname}" } # replace whitespace in file name $cur_file_real = regsubst($cur_file, '\s+', '_', 'G') if $::osfamily == 'RedHat' { if (versioncmp($::sudoversion, '1.7.2p1') < 0) { warning("Found sudo with version ${::sudoversion}, but at least version 1.7.2p1 is required!") } } if $content != undef { if $content =~ Array { $lines = join($content, "\n") $content_real = "# This file is managed by Puppet; changes may be overwritten\n${lines}\n" } else { $content_real = "# This file is managed by Puppet; changes may be overwritten\n${content}\n" } } elsif $template != undef { $content_real = template($template) } else { $content_real = undef } if $ensure == 'present' { if $sudo::validate_single { $validate_cmd_real = 'visudo -c -f %' } else { $validate_cmd_real = undef } if $sudo::delete_on_error { $notify_real = Exec["sudo-syntax-check for file ${cur_file}"] $delete_cmd = "( rm -f '${cur_file_real}' && exit 1)" } else { $notify_real = Exec["sudo-syntax-check for file ${cur_file}"] $errormsg = "Error on global-syntax-check with file ${cur_file_real}" $delete_cmd = "( echo '${errormsg}' && echo '#${errormsg}' >>${cur_file_real} && exit 1)" } } else { $delete_cmd = '' $notify_real = undef $validate_cmd_real = undef } file { "${priority_real}_${dname}": ensure => $ensure, path => $cur_file_real, owner => 'root', group => $sudo::params::config_file_group, mode => $sudo::params::config_file_mode, source => $source, content => $content_real, notify => $notify_real, require => File[$sudo_config_dir_real], validate_cmd => $validate_cmd_real, } exec {"sudo-syntax-check for file ${cur_file}": command => "visudo -c || ${delete_cmd}", refreshonly => true, path => $sudo_syntax_path, } } diff --git a/manifests/init.pp b/manifests/init.pp index 5b48be5..c076b63 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -1,207 +1,207 @@ # Class: sudo # # This module manages sudo # # Parameters: # [*ensure*] # Ensure if present or absent. # Default: present # # [*package*] # Name of the package. # Only set this, if your platform is not supported or you know, # what you're doing. # Default: auto-set, platform specific # # [*package_ensure*] # Allows you to ensure a particular version of a package # Default: present / lastest for RHEL < 5.5 # # [*package_source*] # Where to find the package. Only set this on AIX (required) and # Solaris (required) or if your platform is not supported or you # know, what you're doing. # # The default for aix is the perzl sudo package. For solaris 10 we # use the official www.sudo.ws binary package. # # Default: AIX: perzl.org # Solaris: www.sudo.ws # # [*package_admin_file*] # Where to find a Solaris 10 package admin file for # an unattended installation. We do not supply a default file, so # this has to be staged separately # # Only set this on Solaris 10 (required) # Default: /var/sadm/install/admin/puppet # # [*purge*] # Whether or not to purge sudoers.d directory # Default: true # # [*purge_ignore*] # Files to exclude from purging in sudoers.d directory # Default: undef # # [*config_file*] # Main configuration file. # Only set this, if your platform is not supported or you know, # what you're doing. # Default: auto-set, platform specific # # [*config_dir*] # Main directory containing sudo snippets, imported via # includedir stanza in sudoers file # Default: auto-set, platform specific # # [*extra_include_dirs*] # Array of additional directories containing sudo snippets # Default: undef # # [*content*] # Alternate content file location # Only set this, if your platform is not supported or you know, # what you're doing. # Default: auto-set, platform specific # # [*ldap_enable*] # Enable ldap support on the package # Default: false # # [*delete_on_error*] # True if you want that the configuration is deleted on an error # during a complete visudo -c run. If false it will just return # an error and will add a comment to the sudoers configuration so # that the resource will be checked at the following run. # Default: true # # [*validate_single*] # Do a validate on the "single" file in the sudoers.d directory. # If the validate fail the file will not be saved or changed # if a file already exist. # Default: false # # [*use_sudoreplay*] # Boolean to enable the usage of sudoreplay. # Default: false # # [*sudoreplay_discard*] # Array of additional command to discard in sudo log. # Default: undef # # [*configs*] # A hash of sudo::conf's # Default: {} # # Actions: # Installs sudo package and checks the state of sudoers file and # sudoers.d directory. # # Requires: # Nothing # # Sample Usage: # class { 'sudo': } # # [Remember: No empty lines between comments and class definition] class sudo ( Boolean $enable = true, Optional[String] $package = $sudo::params::package, Optional[String] $package_ldap = $sudo::params::package_ldap, String $package_ensure = $sudo::params::package_ensure, Optional[String] $package_source = $sudo::params::package_source, Optional[String] $package_admin_file = $sudo::params::package_admin_file, Boolean $purge = true, Optional[Variant[String, Array[String]]] $purge_ignore = undef, String $config_file = $sudo::params::config_file, Boolean $config_file_replace = true, String $config_file_mode = $sudo::params::config_file_mode, String $config_dir = $sudo::params::config_dir, String $config_dir_mode = $sudo::params::config_dir_mode, Optional[Array[String]] $extra_include_dirs = undef, String $content = $sudo::params::content, Boolean $ldap_enable = false, Boolean $delete_on_error = true, Boolean $validate_single = false, Boolean $config_dir_keepme = $sudo::params::config_dir_keepme, Boolean $use_sudoreplay = false, Optional[Array[String]] $sudoreplay_discard = undef, Hash $configs = {}, ) inherits sudo::params { case $enable { true: { $dir_ensure = 'directory' $file_ensure = 'present' } false: { $dir_ensure = 'absent' $file_ensure = 'absent' } default: { fail('no $enable is set') } } case $ldap_enable { true: { if $package_ldap == undef { fail('on your os ldap support for sudo is not yet supported') } $package_real = $package_ldap } false: { $package_real = $package } default: { fail('no $ldap_enable is set') } } if $package_real { - class { '::sudo::package': + class { 'sudo::package': package => $package_real, package_ensure => $package_ensure, package_source => $package_source, package_admin_file => $package_admin_file, ldap_enable => $ldap_enable, before => [ File[$config_file], File[$config_dir] ], } } file { $config_file: ensure => $file_ensure, owner => 'root', group => $sudo::params::config_file_group, mode => $config_file_mode, replace => $config_file_replace, content => template($content), } file { $config_dir: ensure => $dir_ensure, owner => 'root', group => $sudo::params::config_file_group, mode => $config_dir_mode, recurse => $purge, purge => $purge, ignore => $purge_ignore, } if $config_dir_keepme { file { "${config_dir}/.keep-me": ensure => file, owner => 'root', group => $sudo::params::config_file_group, } } $configs.each |$config_name, $config| { sudo::conf { $config_name: * => $config, } } if $package_real { anchor { 'sudo::begin': } -> Class['sudo::package'] -> anchor { 'sudo::end': } } } diff --git a/manifests/package.pp b/manifests/package.pp index b229ca4..1c6e6c6 100644 --- a/manifests/package.pp +++ b/manifests/package.pp @@ -1,81 +1,81 @@ # == Class: sudo::package # # Installs the sudo package on various platforms. # # === Parameters # # Document parameters here. # # [*package*] # The name of the sudo package to be installed # # [*package_ensure*] # Ensure if present or absent # # [*package_source*] # Where to find the sudo packge, should be a local file or a uri # # === Examples # # class { sysdoc::package # package => 'sudo', # } # # === Authors # # Toni Schmidbauer # # === Copyright # # Copyright 2013 Toni Schmidbauer # class sudo::package( $package = '', $package_ensure = present, $package_source = '', $package_admin_file = '', $ldap_enable = false, ) { if $ldap_enable == true { case $::osfamily { 'Gentoo': { - if defined( '::portage' ) { - Class['::sudo'] -> Class['::portage'] + if defined( 'portage' ) { + Class['sudo'] -> Class['portage'] package_use { 'app-admin/sudo': ensure => present, use => ['ldap'], target => 'sudo-flags', } } else { fail ('portage package needed to define ldap use on sudo') } } default: { } } } case $::osfamily { 'AIX': { - class { '::sudo::package::aix': + class { 'sudo::package::aix': package => $package, package_source => $package_source, package_ensure => $package_ensure, } } 'Darwin': {} 'Solaris': { - class { '::sudo::package::solaris': + class { 'sudo::package::solaris': package => $package, package_source => $package_source, package_ensure => $package_ensure, package_admin_file => $package_admin_file, } } default: { if $package != '' { ensure_packages([$package], {'ensure' => $package_ensure}) } } } }