Name: sudo
Owner: LinuxONE and Linux on z Systems Open-source Team
Description: Development repository for sudo cookbook
Created: 2016-04-12 16:44:46.0
Updated: 2016-04-12 16:44:46.0
Pushed: 2016-04-13 04:39:32.0
Homepage: https://supermarket.chef.io/cookbooks/sudo
Size: 225
Language: Ruby
GitHub Committers
User | Most Recent Commit | # Commits |
---|
Other Committers
User | Most Recent Commit | # Commits |
---|
The Chef sudo
cookbook installs the sudo
package and configures the /etc/sudoers
file.
It also exposes an LWRP for adding and managing sudoers.
node['authorization']['sudo']['groups']
- groups to enable sudo access (default: [ "sysadmin" ]
)node['authorization']['sudo']['users']
- users to enable sudo access (default: []
)node['authorization']['sudo']['passwordless']
- use passwordless sudo (default: false
)node['authorization']['sudo']['include_sudoers_d']
- include and manage /etc/sudoers.d
(default: false
)node['authorization']['sudo']['agent_forwarding']
- preserve SSH_AUTH_SOCK
when sudoing (default: false
)node['authorization']['sudo']['sudoers_defaults']
- Array of Defaults
entries to configure in /etc/sudoers
node['authorization']['sudo']['setenv']
- Whether to permit preserving of environment with sudo -E
(default: false
)To use attributes for defining sudoers, set the attributes above on the node (or role) itself:
efault_attributes": {
"authorization": {
"sudo": {
"groups": ["admin", "wheel", "sysadmin"],
"users": ["jerry", "greg"],
"passwordless": "true"
}
}
uby
les/example.rb
ult_attributes(
uthorization" => {
"sudo" => {
"groups" => ["admin", "wheel", "sysadmin"],
"users" => ["jerry", "greg"],
"passwordless" => true
}
Note that the template for the sudoers file has the group “sysadmin” with ALL:ALL permission, though the group by default does not exist.
Configure a node attribute, node['authorization']['sudo']['sudoers_defaults']
as an array of Defaults
entries to configure in /etc/sudoers
. A list of examples for common platforms is listed below:
Debian
.default['authorization']['sudo']['sudoers_defaults'] = ['env_reset']
Ubuntu 10.04
.default['authorization']['sudo']['sudoers_defaults'] = ['env_reset']
Ubuntu 12.04
.default['authorization']['sudo']['sudoers_defaults'] = [
nv_reset',
ecure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"'
FreeBSD
.default['authorization']['sudo']['sudoers_defaults'] = [
nv_reset',
ecure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"'
RHEL family 5.x The version of sudo in RHEL 5 may not support +=
, as used in env_keep
, so its a single string.
.default['authorization']['sudo']['sudoers_defaults'] = [
visiblepw',
nv_reset',
nv_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR \
LS_COLORS MAIL PS1 PS2 QTDIR USERNAME \
LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION \
LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC \
LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS \
_XKB_CHARSET XAUTHORITY"'
RHEL family 6.x
.default['authorization']['sudo']['sudoers_defaults'] = [
visiblepw',
nv_reset',
nv_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"',
nv_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"',
nv_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"',
nv_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"',
nv_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"',
nv_keep += "HOME"',
lways_set_home',
ecure_path = /sbin:/bin:/usr/sbin:/usr/bin'
Mac OS X
.default['authorization']['sudo']['sudoers_defaults'] = [
nv_reset',
nv_keep += "BLOCKSIZE"',
nv_keep += "COLORFGBG COLORTERM"',
nv_keep += "__CF_USER_TEXT_ENCODING"',
nv_keep += "CHARSET LANG LANGUAGE LC_ALL LC_COLLATE LC_CTYPE"',
nv_keep += "LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME"',
nv_keep += "LINES COLUMNS"',
nv_keep += "LSCOLORS"',
nv_keep += "TZ"',
nv_keep += "DISPLAY XAUTHORIZATION XAUTHORITY"',
nv_keep += "EDITOR VISUAL"',
nv_keep += "HOME MAIL"'
Note Sudo version 1.7.2 or newer is required to use the sudo LWRP as it relies on the “#includedir” directive introduced in version 1.7.2. The recipe does not enforce installing the version. To use this LWRP, set node['authorization']['sudo']['include_sudoers_d']
to true
.
There are two ways for rendering a sudoer-fragment using this LWRP:
Both methods will create the /etc/sudoers.d/#{resourcename}
file with the correct permissions.
The LWRP also performs fragment validation. If a sudoer-fragment is not valid, the Chef run will throw an exception and fail. This ensures that your sudoers file is always valid and cannot become corrupt (from this cookbook).
Example using the built-in template:
'tomcat' do
er "%tomcat" # or a username
nas 'app_user' # or 'app_user:tomcat'
mmands ['/etc/init.d/tomcat restart']
uby
'tomcat' do
mplate 'my_tomcat.erb' # local cookbook template
riables :cmds => ['/etc/init.d/tomcat restart']
In either case, the following file would be generated in /etc/sudoers.d/tomcat
is file is managed by Chef for node.example.com
NOT modify this file directly.
cat ALL=(app_user) /etc/init.d/tomcat restart
Attribute | Description | Example | Default |
---|---|---|---|
name | name of the `/etc/sudoers.d` file | restart-tomcat | current resource name |
commands | array of commands this sudoer can execute | ['/etc/init.d/tomcat restart'] | ['ALL'] |
group | group to provide sudo privileges to, except `%` is prepended to the name in case it is not already | %admin | |
nopasswd | supply a password to invoke sudo | true | false |
runas | User the command(s) can be run as | root | ALL |
template | the erb template to render instead of the default | restart-tomcat.erb | |
user | user to provide sudo privileges to | tomcat | |
defaults | array of defaults this user has | ['!requiretty','env_reset'] | |
setenv | whether to permit the preserving of environment with `sudo -E` | true | |
env_keep_add | array of strings to add to env_keep | ['HOME', 'MY_ENV_VAR MY_OTHER_ENV_VAR'] | |
env_keep_subtract | array of strings to remove from env_keep | ['DISPLAY', 'MY_SECURE_ENV_VAR'] | |
variables | the variables to pass to the custom template | :commands => ['/etc/init.d/tomcat restart'] |
If you use the template attribute, all other attributes will be ignored except for the variables attribute.
This section details “quick development” steps. For a detailed explanation, see [[Contributing.md]].
Clone this repository from GitHub:
t clone git@github.com:chef-cookbooks/sudo.git
Create a git branch
t checkout -b my_bug_fix
Install dependencies:
ndle install
Make your changes/patches/fixes, committing appropiately
Write tests
Run the tests:
bundle exec foodcritic -f any .
bundle exec rspec
bundle exec rubocop
bundle exec kitchen test
In detail:
Foodcritic will catch any Chef-specific style errors
RSpec will run the unit tests
Rubocop will check for Ruby-specific style errors
Test Kitchen will run and converge the recipes
Author: Bryan W. Berry bryan.berry@gmail.com
Author: Cookbook Engineering Team (cookbooks@chef.io)
Copyright: 2008-2016, Chef Software, Inc.
nsed under the Apache License, Version 2.0 (the "License");
may not use this file except in compliance with the License.
may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
ss required by applicable law or agreed to in writing, software
ributed under the License is distributed on an "AS IS" BASIS,
OUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
the License for the specific language governing permissions and
tations under the License.