feature: Privilege providers #479
Conversation
|
This is a pretty early rough draft, it still needs clean up. I am placing a draft here for anyone who wishes to test this and have input while I still clean up and play with the code. To use this, you will need a The privilege: doasIf you want to specify using sudo: privilege: sudoHowever, Another note that I need help testing. I had some issues with getting the password prompt for Test also need to be adjusted. I will get to that also. For my testing when developing: ~/Testing/manifests/ tree
.
├── Comtrya.yaml
└── command.yamlComtrya.yaml privilege: doas
variables:
test: "one"command.yaml where: variables.test == "one"
actions:
- action: command.run
command: echo
args:
- Starting test.....
- action: command.run
command: echo
privileged: true
args:
- {{ variables.test }}
- action: command.run
command: echo
args:
- Ending test....From within my comtrya apply |
|
@yonas Here is a branch with a draft PR if you would like to test this. If you need more instructions, let me know. There are some above this comment. |
|
@martintc Thanks, this worked for me.
I can't reproduce this. I get a password prompt without |
|
My only suggestion is to add some auto-detect logic so that non-default options like This could be overridden by adding the privilege context to |
It could just be my system and having compiled opendoas for it to work on macOS, haha. I'd try it on my BSD machine, but I am currently out of town, so no access to it. |
|
Update for those watching. What else is lefts:
|
|
Codecov ReportAttention: Patch coverage is
❗ Your organization needs to install the Codecov GitHub app to enable full functionality. Additional details and impacted files@@ Coverage Diff @@
## main #479 +/- ##
==========================================
- Coverage 28.59% 26.84% -1.75%
==========================================
Files 85 85
Lines 2301 2395 +94
==========================================
- Hits 658 643 -15
- Misses 1643 1752 +109 ☔ View full report in Codecov by Sentry. |
|
I think I've got everything buttoned up and ready to pull this in. I will leave the PR for a couple of days for testing and if anyone wishes to review. If no comments or feedback, I intend to pull this in and work on adding run0 and extra testing followed by documentation. The plan from there would be a v0.9.0 release if all goes well. I have a feeling there is a future refactor hiding here, but I think that is a future me problem. |
I'm submitting a
What is the current behaviour?
Comtrya also utilizes
sudofor privilege escalation.If the current behavior is a bug, please provide the steps to reproduce and if possible a minimal demo of the problem
What is the expected behavior?
Add the ability to specify a provider for privilege escalation with the initial offering of using
doasas a privilege provider.What is the motivation / use case for changing the behavior?
Issue #429
Please tell us about your environment:
Version (
comtrya --version): 0.8.9Operating system: macOS 15.0