zuul/zuul-jobs
Code Issues Proposed changes

Merge "revoke-sudo: delete cloud-config sudoers file"

Browse Source
This commit is contained in:
Zuul 2020-11-13 14:09:05 +00:00 committed by Gerrit Code Review
commit e53edc292b
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
roles/revoke-sudo/tasks/main.yaml
View File

@ -3,11 +3,13 @@
failed_when: false
register: zuul_is_sudoer
# We do this in one command and not in a loop
# to make sure we don't revoke sudo in the first file
# and then error because we lost sudo access when we
# try to delete the next file.
- name: Remove sudo access for zuul user.
become: yes
file:
path: /etc/sudoers.d/zuul
state: absent
command: rm -rf /etc/sudoers.d/zuul /etc/sudoers.d/90-cloud-init-users # noqa 302
when: zuul_is_sudoer.rc == 0
- name: Prove that general sudo access is actually revoked.