Bug 1788035
| Summary: | [ansible-freeipa] Not able to remove cmd members from sudo rule. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Varun Mylaraiah <mvarun> |
| Component: | ansible-freeipa | Assignee: | Rafael Jeffman <rjeffman> |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.2 | CC: | rjeffman, twoerner |
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
| Target Release: | 8.0 | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ansible-freeipa-0.1.8-2.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-04-28 16:01:57 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Here is the upstream PR https://github.com/freeipa/ansible-freeipa/pull/178 Verified
Manual execution console output:
================================
# rpm -q ansible-freeipa
ansible-freeipa-0.1.8-3.el8.noarch
[root@master ~]# ipa sudorule-show sudorule035
Rule name: sudorule035
Enabled: TRUE
Sudo Allow Commands: /usr/bin/df
[root@ansible ~]# cat sudo_0035.yaml
---
- name: Playbook to handle sudorules
hosts: ipaserver
become: true
tasks:
- ipasudorule:
ipaadmin_password: <xxxxxxx>
name: sudorule035
allow_sudocmd: /usr/bin/df
action: member
state: absent
[root@ansible ~]# ansible-playbook -vv -i inventory/server.hosts sudo_0035.yaml
ansible-playbook 2.9.5
config file = /etc/ansible/ansible.cfg
configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python3.6/site-packages/ansible
executable location = /usr/bin/ansible-playbook
python version = 3.6.8 (default, Dec 5 2019, 15:45:45) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5)]
Using /etc/ansible/ansible.cfg as config file
PLAYBOOK: sudo_0035.yaml *********************************************************************************************
1 plays in sudo_0035.yaml
PLAY [Playbook to handle sudorules] **********************************************************************************
TASK [Gathering Facts] ***********************************************************************************************
task path: /root/sudo_0035.yaml:2
ok: [master.ipadomain.test]
META: ran handlers
TASK [ipasudorule] ***************************************************************************************************
task path: /root/sudo_0035.yaml:7
changed: [master.ipadomain.test] => {"changed": true}
META: ran handlers
META: ran handlers
PLAY RECAP ***********************************************************************************************************
master.ipadomain.test : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
[root@master ~]# ipa sudorule-show sudorule035
Rule name: sudorule035
Enabled: TRUE
Automated test console output: =============================== 2020-03-06T10:34:11 ansible_freeipa_tests/sudo_module.py::Testsudorule01_02_09_07::test_delete_sudorule_members 2020-03-06T10:34:11 [1m-------------------------------- live log call ---------------------------------[0m 2020-03-06T10:34:11 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kinit', 'admin'] 2020-03-06T10:34:11 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['ipa', 'sudorule-show', 'sudorule_1788024'] 2020-03-06T10:34:12 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kdestroy', '-A'] 2020-03-06T10:34:12 [pytest_multihost.host.Host.ansible.ParamikoTransport] [32mINFO[0m WRITE inventory/sudo.hosts 2020-03-06T10:34:12 [pytest_multihost.host.Host.ansible.ParamikoTransport] [32mINFO[0m PUT sudo_module.yml 2020-03-06T10:34:12 [pytest_multihost.host.Host.ansible.ParamikoTransport] [32mINFO[0m RUN ['ansible-playbook', '--ssh-extra-args="-o StrictHostKeyChecking=no"', '-vv', '-i', 'inventory/sudo.hosts', 'sudo_module.yml'] 2020-03-06T10:34:18 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kinit', 'admin'] 2020-03-06T10:34:18 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['ipa', 'sudorule-show', 'sudorule_1788024'] 2020-03-06T10:34:20 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kdestroy', '-A'] 2020-03-06T10:34:20 [32mPASSED[0m[36m [ 75%][0m Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:1705 |
Description of problem: Not able to remove cmd members from sudo rule in Sudo module. Version-Release number of selected component (if applicable): ansible-freeipa-0.1.8-1.el8.noarch Steps to Reproduce: Before running playbook ====================== On Master: [root@master ~]# ipa sudorule-show sudorule1 Rule name: sudorule1 Enabled: TRUE Users: testuser01 User Groups: group_test01 Hosts: host01.ipadomain.test Host Groups: freeipa-team Sudo Allow Commands: /usr/bin/df [root@ansible ~]# cat 029_sudorule_delete_members.yaml --- - name: Playbook to handle sudorules hosts: ipaserver become: true tasks: - ipasudorule: ipaadmin_password: <xxxxx> name: sudorule1 user: testuser01 cmd: /usr/bin/df action: member state: absent [root@ansible ~]# ansible-playbook -vv -i inventory/server.hosts 029_sudorule_delete_members.yaml ansible-playbook 2.9.2 config file = /etc/ansible/ansible.cfg configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python3.6/site-packages/ansible executable location = /usr/bin/ansible-playbook python version = 3.6.8 (default, Dec 5 2019, 15:45:45) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5)] Using /etc/ansible/ansible.cfg as config file PLAYBOOK: 029_sudorule_delete_members.yaml *************************************************************************** 1 plays in 029_sudorule_delete_members.yaml PLAY [Playbook to handle sudorules] ********************************************************************************** TASK [Gathering Facts] *********************************************************************************************** task path: /root/029_sudorule_delete_members.yaml:2 ok: [master.ipadomain.test] META: ran handlers TASK [ipasudorule] *************************************************************************************************** task path: /root/029_sudorule_delete_members.yaml:7 changed: [master.ipadomain.test] => {"changed": true} META: ran handlers META: ran handlers PLAY RECAP *********************************************************************************************************** master.ipadomain.test : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 After running playbook ====================== On Master: [root@master ~]# ipa sudorule-show sudorule1 Rule name: sudorule1 Enabled: TRUE User Groups: group_test01 Hosts: host01.ipadomain.test Host Groups: freeipa-team Sudo Allow Commands: /usr/bin/df Sudo Deny Commands: /usr/bin/df Actual results: Instead of removing cmd member from "Sudo Allow Commands", it is adding to “Sudo Deny Commands” Expected results: Should remove from "Sudo Allow Commands". Additional info: In CLI We have separate options to add and remove for both "Sudo Allow Commands" and “Sudo Deny Commands” sudorule-add-allow-command -- Add commands and sudo command groups affected by Sudo Rule. sudorule-add-deny-command -- Add commands and sudo command groups affected by Sudo Rule. sudorule-remove-allow-command -- Remove commands and sudo command groups affected by Sudo Rule. sudorule-remove-deny-command -- Remove commands and sudo command groups affected by Sudo Rule.