Skip to content

authselect remediation macro removed sudo rights #15049

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nnerdmann wants to merge 1 commit into
base: master
Choose a base branch
from
+3 −17
Open

authselect remediation macro removed sudo rights #15049

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 2 additions & 13 deletions shared/macros/10-ansible.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2156,31 +2156,20 @@ Part of the grub2_bootloader_argument_absent template.
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)

- name: '{{{ rule_title }}} - Ensure the authselect custom profile is selected'
- name: '{{{ rule_title }}} - Ensure the authselect custom profile and features are selected'
ansible.builtin.command:
cmd: authselect select {{ authselect_custom_profile }}
cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)

- name: '{{{ rule_title }}} - Restore the authselect features in the custom profile'
ansible.builtin.command:
cmd: authselect enable-feature {{ item }}
loop: "{{ result_authselect_features.stdout_lines }}"
register: result_pam_authselect_restore_features
when:
- result_authselect_profile is not skipped
- result_authselect_features is not skipped
- result_pam_authselect_select_profile is not skipped

{{{ ansible_apply_authselect_changes('after-hardening-custom-profile', rule_title=rule_title) }}}
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- result_pam_authselect_restore_features is not skipped
{{%- endmacro %}}


Expand Down
5 changes: 1 addition & 4 deletions shared/macros/10-bash.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2587,10 +2587,7 @@ if [[ ! $CURRENT_PROFILE == custom/* ]]; then
authselect create-profile hardening -b $CURRENT_PROFILE
CURRENT_PROFILE="custom/hardening"
{{{ bash_apply_authselect_changes('before-hardening-custom-profile') | indent(4) }}}
authselect select $CURRENT_PROFILE
for feature in $ENABLED_FEATURES; do
authselect enable-feature $feature;
done
authselect select $CURRENT_PROFILE $ENABLED_FEATURES
{{{ bash_apply_authselect_changes('after-hardening-custom-profile') | indent(4) }}}
fi
{{%- endmacro %}}
Expand Down
Loading