sudo: properly allow wheel group to use sudo via visudo

[ljmf00]

Signed-off-by: Luís Ferreira contact@lsferreira.net

---

The same approach on Arch Linux infrastructure https://git.archlinux.org/infrastructure.git/tree/roles/sudo/tasks/main.yml as sudoers file already has entries for what is done here previously. Also it's better to use visudo to edit /etc/sudoers.

This approach will unsure that running ansible twice won't break /etc/sudoers file.

[FFY00]

Please keep sudores.d support and just install a new file there with your config.

[FFY00]

Sorry.

[ljmf00]

Please keep sudores.d support and just install a new file there with your config.

The sudoers.d support is enabled by default on arch. The previous method mess some things up when running the ansible playbook.

This is what the default configuration looks like:


## Read drop-in files from /etc/sudoers.d
@includedir /etc/sudoers.d

So instead of modifying the sudoers, you propose to add the changes on /etc/sudoers.d seperate files?

[FFY00]

The sudoers.d support is enabled by default on arch.

Yes, but that can change anytime.

The previous method mess some things up when running the ansible playbook.

Could you elaborate?

So instead of modifying the sudoers, you propose to add the changes on /etc/sudoers.d seperate files?

Yes, that avoids all this regex complexity. Also, the current regex is easily breakable, if we go with the regex approach we should use something a bit better.

[ljmf00]

Yes, but that can change anytime.

Sure, then I propose to have our own sudoers template, instead.

Could you elaborate?

The problem I faced is because /etc/sudoers changed on a new update, and by adding includedir like this:

- name: enable sudoers.d support
  lineinfile:
    path: /etc/sudoers
    line: '#includedir /etc/sudoers.d'

With the new configuration, it will write something like:


## Read drop-in files from /etc/sudoers.d
@includedir /etc/sudoers.d
#includedir /etc/sudoers.d

And will include the files inside sudoers.d twice. See the error when running something with sudo:

/etc/sudoers.d/archbuild:5: Alias "ARCHBUILD" already defined
                       /usr/bin/makerepropkg

Yes, that avoids all this regex complexity. Also, the current regex is easily breakable, if we go with the regex approach we should use something a bit better.

Yeah agree.