Puppet augeas and sudoers parameter lists

Today I had little problems with Puppet’s augeas. I tried hard to find some documentation helping me out but did not find anything suitable. So I think I’m not the only one facing that problem so I want to share what I did.

I want to change the /etc/sudoers file on Linux system with Puppet. What I want to do is negate the requiretty default and add SSH_AUTH_SOCK to the env_keep list.

My first problem was the requitetty setting. I tried a lot until I got a working solution. The problem was the value needed in the Puppet augeas set statement. I developed the following solution:

augeas { "sudoers":
   context => '/files/etc/sudoers/',
   changes => ["set Defaults/requiretty/negate ''"];
}

The second problem was a little bit harder to solve. Adding the SSH_AUTH_SOCK value to the env_keep list of the defaults. First of all env_keep is a list as mentioned before.

Defaults env_reset
Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

Above you can see the settings for env_keep which I want to change. I want to add SSH_AUTH_SOCK at the end of the list. And I only want to add the value once and not with every Puppet run. So I need a possibility to check if the setting is already done. To achive this, there is an „onlyif“ statement you can add to the augeas call. But it was a little bit difficult to find a way how to do it because 

match /files/etc/sudoers/Defaults/env_keep not_includes SSH_AUTH_SOCK

won’t work. The reason why it is not working is that the match returns a list of env_keep lines.The not_included checks the return value of the „match <arg>“ command which is a list in our case.

After figuring out the problem with the match art I found asolution to get it work:

augeas { "sudoers-env":
   onlyif => "match /files/etc/sudoers/Defaults/env_keep[last()]/var[.='SSH_AUTH_SOCK'] size == 0",
   changes => "set /files/etc/sudoers/Defaults/env_keep[last()]/var[last()+1]/ SSH_AUTH_SOCK"
}

The SSH_AUTH_SOCK value is always appended to the end of the last env_keep line. The result after the Puppet run looks like this

Defaults env_reset
Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY SSH_AUTH_SOCK"

Finally I succeeded. But it costs me a lot of time for Googling and trying out things. So I hope this short documentation will help anyone else to get a quicker solution and save time for anybody else.