Skip to content

Commit 7ee2569

Browse files
committed
fix(config): remove dictsort that breaks sudoers
in bc62b6e dictsort was applied to the pillar entries. But in the sudoers file *order matters* so, using `dictsort`, breaks it. From man 5 sudoers: > When multiple entries match for a user, they are > applied in order. Where there are multiple matches, the last match > is used (which is not necessarily the most specific match). Removed `dictsort` from the {users,groups,netgroups} specifications. BREAKING CHANGE: sudoers entries' order will change and might break existing configuration. You should check your pillars and rendering.
1 parent b8a8f6f commit 7ee2569

File tree

1 file changed

+7
-7
lines changed

1 file changed

+7
-7
lines changed

sudoers/files/sudoers

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -84,24 +84,24 @@ Cmnd_Alias {{ name }} = {{ ",".join(commands) }}
8484
Runas_Alias {{ name }} = {{ ",".join(runas) }}
8585
{%- endfor %}
8686

87-
# User privilege specification
88-
{%- for user,specs in users|dictsort %}
87+
# Netgroup privilege specification
88+
{%- for netgroup,specs in netgroups.items() %}
8989
{%- for spec in specs %}
90-
{{ user }} {{ spec }}
90+
+{{ netgroup }} {{ spec }}
9191
{%- endfor %}
9292
{%- endfor %}
9393

9494
# Group privilege specification
95-
{%- for group,specs in groups|dictsort %}
95+
{%- for group,specs in groups.items() %}
9696
{%- for spec in specs %}
9797
%{{ group }} {{ spec }}
9898
{%- endfor %}
9999
{%- endfor %}
100100

101-
# Netgroup privilege specification
102-
{%- for netgroup,specs in netgroups.items() %}
101+
# User privilege specification
102+
{%- for user,specs in users.items() %}
103103
{%- for spec in specs %}
104-
+{{ netgroup }} {{ spec }}
104+
{{ user }} {{ spec }}
105105
{%- endfor %}
106106
{%- endfor %}
107107

0 commit comments

Comments
 (0)