Feature Request: Support for 'include' in the provider

[mmarod]

There does not appear to be any way to specify something like this...

@include common-account
@include common-password
@include common-session

Seems like the 'type' parameter could just be extended to add support for 'include'.

Thanks!

[raphink]

What kind of syntax would you suggest?

[njm506]

On RedHat-like systems, it's already possible as they use lines like:
auth include password-auth
These can be managed using syntax like this:

pam { 'No password-auth for SSH (RedHat)':
  ensure  => absent,
  service => 'sshd',
  type    => 'auth',
  control => 'include',
  module  => 'password-auth',
}

For compatibility with the above, something like this might make sense (just omit 'type') - if this is straightforward:

pam { 'No common-auth for SSH (Debian)':
  ensure  => absent,
  service => 'sshd',
  control => 'include',
  module  => 'common-auth',
}

At the moment, I have a separate augeas resource to do this, but it interacts in interesting ways with the pam augeas provider, depending on the order things happen in.

[raphink]

If it's an order problem, have you consider using the position parameter?

[njm506]

Sorry, I didn't make my previous post that clear; the bit about the separate augeas resource was just an aside (the ordering thing might just be an ordinary case of making sure Puppet does the two things in a suitable order).

What I was suggesting was merely a possible syntax to implement for managing @include lines.

[raphink]

Right. Hence my earlier question: what kind of syntax would you suggest for it?

[njm506]

That was what I was suggesting there - the syntax I think would be appropriate for managing:

@include common-auth

would be:

pam { 'SSH - common-auth':
  ensure  => present,       # Or absent, if you don't want it
  service => 'sshd',
  control => 'include',     # Note - no "type" parameter for this style of @include (as it applies to everything)
  module  => 'common-auth',
}

[devicenull]

It looks like the upstream augeas code already supports this - https://github.com/hercules-team/augeas/blob/master/lenses/pam.aug#L47

However, it's definitely not obvious to me the interaction between the lens and this module works. I think the syntax in the previous comment would be fine