Skip to content

Commit

Permalink
Explicitly set !requiretty for the bootstrap__sudo_group.
Browse files Browse the repository at this point in the history
This ensures that `sudo` with `rsync` is allowed
for the `bootstrap__sudo_group` even when `requiretty`` has been
configured to be the default for users.

I use [a role to configure sudo](https://github.com/ypid/ansible-sudo) on my
systems and set `!requiretty` as default.

Form the manpage:

> If set, sudo will only run when the user is logged in to a real tty.  When this
> flag is set, sudo can only be run from a login session and not via other means
> such as cron(8) or cgi-bin scripts.  This flag is off by default.

So this patch is only required when the admin has changed the default from
`!requiretty` to `requiretty` and wants to use `sudo` with `rsync` as a user in
the `bootstrap__sudo_group`.

Related to: ansible/ansible#4676 (comment)
  • Loading branch information
ypid committed Jun 6, 2016
1 parent 30ffac0 commit a739a4f
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 0 deletions.
10 changes: 10 additions & 0 deletions CHANGES.rst
Original file line number Diff line number Diff line change
@@ -1,6 +1,16 @@
Changelog
=========

v0.2.2
------

*Unreleased*

- Explicitly set ``!requiretty`` for the :any:`bootstrap__sudo_group`
(:manpage:`sudoers(5)`). This ensures that ``sudo`` with ``rsync`` is allowed
for the :any:`bootstrap__sudo_group` even when ``requiretty`` has been
configured to be the default for users.

v0.2.1
------

Expand Down
3 changes: 3 additions & 0 deletions tasks/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@
owner: 'root'
group: 'root'
mode: '0755'
tags: [ 'role::bootstrap:hostname' ]

- name: Gather host facts
action: setup
Expand Down Expand Up @@ -132,6 +133,8 @@
validate: 'visudo -cf "%s"'
tags: [ 'role::bootstrap:admin' ]
with_items:
- regexp: '^Defaults: %{{ bootstrap__sudo_group }} !?requiretty'
line: 'Defaults: %{{ bootstrap__sudo_group }} !requiretty'
- regexp: '^Defaults: %{{ bootstrap__sudo_group }} env_check\s'
line: 'Defaults: %{{ bootstrap__sudo_group }} env_check += "SSH_CLIENT"'
- regexp: '^%{{ bootstrap__sudo_group }}\s'
Expand Down

0 comments on commit a739a4f

Please sign in to comment.