22 lines
833 B
Bash
22 lines
833 B
Bash
#!/usr/bin/env bash
|
|
# policy: usr_admin — global sudo grant for FreeIPA usr_admin user group.
|
|
# When the IPA group exists, a sudoers drop-in grants full sudo (SSSD-resolved).
|
|
# The drop-in is removed when the group is deleted from FreeIPA.
|
|
|
|
USR_ADMIN_DROPIN="/etc/sudoers.d/ansipa-usr-admin"
|
|
USR_ADMIN_STATE="$STATE_DIR/usr-admin"
|
|
|
|
if [[ "$WANT_USR_ADMIN" == true ]]; then
|
|
if [[ ! -f "$USR_ADMIN_DROPIN" ]]; then
|
|
log "Installing usr_admin sudoers drop-in"
|
|
printf '%%usr_admin ALL=(ALL:ALL) ALL\n' > "$USR_ADMIN_DROPIN"
|
|
chmod 440 "$USR_ADMIN_DROPIN"
|
|
fi
|
|
touch "$USR_ADMIN_STATE"
|
|
else
|
|
if [[ -f "$USR_ADMIN_STATE" ]] || [[ -f "$USR_ADMIN_DROPIN" ]]; then
|
|
rm -f "$USR_ADMIN_DROPIN" "$USR_ADMIN_STATE"
|
|
log "Removed usr_admin sudoers drop-in (IPA group no longer exists)"
|
|
fi
|
|
fi
|