Skip to content

Commit

Permalink
Adopt gpasswd command for Bash remediation
Browse files Browse the repository at this point in the history
Thanks @teacup-on-rockingchair for suggesting this command.
Also used the command in group_without_members.pass.sh test scenario.
It is intentional to not update the Ansible remediation since it would
demand to use the command module. But the gpasswd command doesn't have
different return codes to know when members were removed or not from the
group. It would make the Ansible task to be reported as changed always
or never, which may cause confusion.
  • Loading branch information
marcusburghardt committed Oct 19, 2023
1 parent babf932 commit 6450fa7
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -7,4 +7,4 @@ if ! grep -q "^${var_pam_wheel_group_for_su}:[^:]*:[^:]*:[^:]*" /etc/group; then
fi

# group must be empty
sed -i -E "s/^(${var_pam_wheel_group_for_su}:[^:]*:[^:]*:)[^:]*/\1/g" /etc/group
gpasswd -M '' ${var_pam_wheel_group_for_su}
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@

GRP_NAME=sugroup
groupadd ${GRP_NAME}
sed -i -E "s/^(${GRP_NAME}:[^:]*:[^:]*:)[^:]*/\1/" /etc/group
gpasswd -M '' ${GRP_NAME}

0 comments on commit 6450fa7

Please sign in to comment.