Join Log in
Score:0
hymie avatar Server

Puppet/Augeas -- ins command worked on RH6, fails on RH7

cn flag
hymie

I have this construct in my puppet module to add a line in /etc/sudoers after the last "Defaults" line:

  augeas { "sudoers.ssh_auth_sock" :
    lens => "Sudoers.lns",
    incl => "/etc/sudoers",
    onlyif  => "match Defaults/env_keep/var[. = 'SSH_AUTH_SOCK'] size==0",
    changes => [
       # Create a new Defaults line for the two variables
       "ins Defaults after Defaults[last()]",
       # Make this Defaults line a += type
       "clear Defaults[last()]/env_keep/append",
       # assign values to the two variables
       "set Defaults[last()]/env_keep/var[1] SSH_AUTH_SOCK",
    ],
  }

It works perfectly on my RedHat 6 machines

Notice: Augeas[sudoers.ssh_auth_sock](provider=augeas):
--- /etc/sudoers        2021-10-12 13:30:52.880901115 +0000
+++ /etc/sudoers.augnew 2021-10-12 13:31:28.697931561 +0000
@@ -77,6 +77,7 @@
 # Defaults   env_keep += "HOME"

 Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin
+Defaults env_keep += SSH_AUTH_SOCK

 ## Next comes the main part: which users can run what software on

Notice: /Stage[main]/Sudoers/Augeas[sudoers.ssh_auth_sock]/returns: executed successfully

But it fails on my RedHat 7 machines:

Warning: Augeas[sudoers.ssh_auth_sock](provider=augeas): Loading failed for one or more files, see debug for /augeas//error output
Error: /Stage[main]/Sudoers/Augeas[sudoers.ssh_auth_sock]: Could not evaluate: Error sending command 'ins' with params ["Defaults", "after", "/files/etc/sudoers/Defaults[last()]"]/Error sending command 'ins' with params ["Defaults", "after", "/files/etc/sudoers/Defaults[last()]"]

Can somebody help me understand what changed, or what I did wrong, so that I can get this snippet to work in both environments?

42
0 + 0
cn flag
raphink
`loading failed` in the logs is a hint that Augeas couldn't parse one or more files. Can you run `augtool errors` and post the output?
0
Reply
hymie avatar
cn flag
hymie
Thank you @raphink -- problem resolved.
1
Reply
Score:1
hymie avatar Server
cn flag
hymie

Thank you @raphink

augtool errors said

Error in /etc/sudoers:96.12 (parse_failed)
  Iterated lens matched less than it should
  Lens: /usr/share/augeas/lenses/dist/sudoers.aug:530.10-.70:
    Last matched: /usr/share/augeas/lenses/dist/sep.aug:47.18-.40:
    Next (no match): /usr/share/augeas/lenses/dist/sudoers.aug:500.16-501.47:

So I checked line 96 of /etc/sudoers and it said

@includedir /etc/sudoers.d

Apparently, @includedir is now a valid syntax in addition to the older-style syntax #includedir ... but (my) augeas lens does not recognize the new version.

(* View: includedir *)
let includedir =
  [ key /#include(dir)?/ . Sep.space . store Rx.fspath . eol ]

I changed the @ to a # in /etc/sudoers and that seems to have resolved the problem.

0 + 0
cn flag
raphink
Great. If the latest Augeas doesn't support this syntax, please open an issue (or even better provide a PR to fix it).
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.