diff --git a/manifests/init.pp b/manifests/init.pp index 5783ee8..1903761 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -44,6 +44,11 @@ $sudoers_file = '' ) { + $sysconfdir = $::osfamily ? { + /FreeBSD/ => '/usr/local/etc', + default => '/etc', + } + create_resources('sudo::sudoers', $sudoers) if $manage_package { @@ -52,10 +57,10 @@ } } - file { '/etc/sudoers.d': + file { "${sysconfdir}/sudoers.d": ensure => directory, owner => 'root', - group => 'root', + group => 0, mode => '0750', purge => $manage_sudoersd, recurse => $manage_sudoersd, @@ -63,10 +68,10 @@ } if $sudoers_file =~ /^puppet:\/\// { - file { '/etc/sudoers': + file { "${sysconfdir}/sudoers": ensure => file, owner => 'root', - group => 'root', + group => 0, mode => '0440', source => $sudoers_file, } diff --git a/manifests/sudoers.pp b/manifests/sudoers.pp index 8dddab8..d7c233d 100644 --- a/manifests/sudoers.pp +++ b/manifests/sudoers.pp @@ -74,7 +74,10 @@ # contain dots. # As having dots in a username is legit, let's fudge $sane_name = regsubst($name, '\.', '_', 'G') - $sudoers_user_file = "/etc/sudoers.d/${sane_name}" + $sudoers_user_file = $::osfamily ? { + /FreeBSD/ => "/usr/local/etc/sudoers.d/${sane_name}", + default => "/etc/sudoers.d/${sane_name}", + } if $sane_name !~ /^[A-Za-z][A-Za-z0-9_]*$/ { fail "Will not create sudoers file \"${sudoers_user_file}\" (for user \"${name}\") should consist of letters numbers or underscores." @@ -88,14 +91,18 @@ file { $sudoers_user_file: content => template('sudo/sudoers.erb'), owner => 'root', - group => 'root', + group => 0, mode => '0440', } + $visudo = $::osfamily ? { + /FreeBSD/ => '/usr/local/sbin/visudo', + default => '/usr/sbin/visudo', + } if versioncmp($::puppetversion, '3.5') >= 0 { - File[$sudoers_user_file] { validate_cmd => '/usr/sbin/visudo -c -f %' } + File[$sudoers_user_file] { validate_cmd => "${visudo} -c -f %" } } else { - validate_cmd(template('sudo/sudoers.erb'), '/usr/sbin/visudo -c -f', 'Visudo failed to validate sudoers content') + validate_cmd(template('sudo/sudoers.erb'), "${visudo} -c -f", 'Visudo failed to validate sudoers content') } } else {