From eb1d298446fceeb7c859e23bee672c5b028c445e Mon Sep 17 00:00:00 2001 From: Ruslan Kiianchuk Date: Mon, 18 Jul 2016 14:01:56 -0700 Subject: [PATCH] Validate sudoers file before copying Ansible `copy` module has `validation` parameter that allows to validate the file prior to replacing it on remote: > The validation command to run before copying into place. The path to the file to validate is passed in via '%s' which must be present as in the example below. The command is passed securely so shell features like expansion and pipes won't work. Here we use `visudo` to validate the file before writing it in place, so the user won't lock himself out in case of incorrect changes to `sudoers.j2` template. --- roles/base/tasks/sudo.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/base/tasks/sudo.yml b/roles/base/tasks/sudo.yml index b658368..bc3335b 100644 --- a/roles/base/tasks/sudo.yml +++ b/roles/base/tasks/sudo.yml @@ -10,6 +10,6 @@ - sudo - name: Copy sudo configuration - template: src=sudoers.j2 dest=/etc/sudoers mode=440 + template: src=sudoers.j2 dest=/etc/sudoers mode=440 validate='visudo -cf %s' tags: - sudo