changed validate_single, rm 2 params, fixes #223#309
Open
tdlc wants to merge 1 commit intosaz:masterfrom
Open
Conversation
To make validate_single to really only validate single files the implementation was changed. If validate_single is true visudo will be called with -f <file>. In case validate_single is false all files will be validated. This makes sense because a single file could break the whole sudoers config, see issue saz#125. Before this commit all files would always be validated no matter which value validate_single had. This might be unwanted if an application installs some file with wrong rights 0440, see issue saz#223. Removed parameter delete_on_error because now an invalid file is never kept. When param was false it could also lead to infinite error messages in the invalid sudoers file. Removed parameter sudo_syntax_path as it is unused now. It cannot be used in puppet file's validate_cmd.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
To make validate_single to really only validate
single files the implementation was changed.
If validate_single is true visudo will be
called with -f . In case validate_single
is false all files will be validated. This
makes sense because a single file could break
the whole sudoers config, see issue #125.
Before this commit all files would always be
validated no matter which value validate_single
had. This might be unwanted if an application
installs some file with wrong rights 0440,
see issue #223.
Removed parameter delete_on_error because now
an invalid file is never kept. When param
was false it could also lead to infinite
error messages in the invalid sudoers file.
Removed parameter sudo_syntax_path as it
is unused now. It cannot be used in puppet
file's validate_cmd.