Skip to content

Commit 77f7e6c

Browse files
myiimyii
authored
Merge pull request #60 from Perceptyx/add-new-unattended-settings
Add new unattended settings
2 parents 5178f0d + 49ee29c commit 77f7e6c

8 files changed

Lines changed: 220 additions & 11 deletions

File tree

‎.travis.yml‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -58,14 +58,22 @@ jobs:
5858
## Define the rest of the matrix based on Kitchen testing
5959
# Make sure the instances listed below match up with
6060
# the `platforms` defined in `kitchen.yml`
61-
- env: INSTANCE=repositories-debian-10-master-py3
62-
- env: INSTANCE=preferences-debian-10-master-py3
63-
# - env: INSTANCE=repositories-ubuntu-1804-master-py3
61+
# - env: INSTANCE=repositories-debian-10-master-py3
62+
# - env: INSTANCE=preferences-debian-10-master-py3
63+
# - env: INSTANCE=unattended-debian-10-master-py3
64+
- env: INSTANCE=debian-10-master-py3
65+
- env: INSTANCE=repositories-ubuntu-1804-master-py3
6466
# - env: INSTANCE=preferences-ubuntu-1804-master-py3
65-
- env: INSTANCE=repositories-debian-9-2019-2-py3
67+
# - env: INSTANCE=unattended-ubuntu-1804-master-py3
68+
# - env: INSTANCE=ubuntu-1804-master-py3
69+
# - env: INSTANCE=repositories-debian-9-2019-2-py3
6670
- env: INSTANCE=preferences-debian-9-2019-2-py3
67-
- env: INSTANCE=repositories-ubuntu-1804-2019-2-py3
68-
- env: INSTANCE=preferences-ubuntu-1804-2019-2-py3
71+
# - env: INSTANCE=unattended-debian-9-2019-2-py3
72+
# - env: INSTANCE=debian-9-2019-2-py3
73+
# - env: INSTANCE=repositories-ubuntu-1804-2019-2-py3
74+
# - env: INSTANCE=preferences-ubuntu-1804-2019-2-py3
75+
- env: INSTANCE=unattended-ubuntu-1804-2019-2-py3
76+
# - env: INSTANCE=ubuntu-1804-2019-2-py3
6977

7078
## Define the release stage that runs `semantic-release`
7179
- stage: 'release'

‎apt/templates/unattended_config.jinja‎

Lines changed: 36 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
########################################################################
2+
# File managed by Salt at <{{ source }}>.
3+
# Your changes will be overwritten.
4+
########################################################################
5+
16
{% set apt = pillar.get('apt', {}) -%}
27
{% set unattended = apt.get('unattended', {}) -%}
38
{% set allowed_origins = unattended.get('allowed_origins', ['${distro_id}:${distro_codename}-security']) -%}
@@ -6,12 +11,28 @@
611
{% set auto_fix_interrupted_dpkg = unattended.get('auto_fix_interrupted_dpkg', 'true') -%}
712
{% set minimal_steps = unattended.get('minimal_steps', 'false') -%}
813
{% set install_on_shutdown = unattended.get('install_on_shutdown', 'false') -%}
9-
{% set mail = unattended.get('mail', 'root') -%}
14+
{% set mail = unattended.get('mail', '') -%}
15+
{% set sender = unattended.get('sender', 'root') -%}
1016
{% set mail_only_on_error = unattended.get('mail_only_on_error', 'false') -%}
11-
{% set remove_unused_dependencies = unattended.get('remove_unused_dependencies', 'true') -%}
17+
{% set mail_report = unattended.get('mail_report', 'on-change') -%}
18+
{% if mail_only_on_error -%}
19+
{% set mail_report = 'only-on-error' -%}
20+
{% endif -%}
21+
{% if mail_report not in ['always', 'only-on-error', 'on-change'] -%}
22+
{{ raise('apt-formula: mail_report should be one of "always", "only-on-error" or "on-change".') }}
23+
{% endif -%}
24+
{% set remove_unused_dependencies = unattended.get('remove_unused_dependencies', 'false') -%}
25+
{% set remove_new_unused_dependencies = unattended.get('remove_new_unused_dependencies', 'true') -%}
1226
{% set automatic_reboot = unattended.get('automatic_reboot', 'false') -%}
1327
{% set automatic_reboot_time = unattended.get('automatic_reboot_time', 'now') -%}
1428
{% set dl_limit = unattended.get('dl_limit', '0') -%}
29+
{% set syslog_enable = unattended.get('syslog_enable', 'false') -%}
30+
{% set syslog_facility = unattended.get('syslog_facility', 'daemon') -%}
31+
{% set package_whitelist_strict = unattended.get('package_whitelist_strict', 'false') -%}
32+
{% set keep_debs_after_install = unattended.get('keep_debs_after_install', 'false') -%}
33+
{% set dpkg_options = unattended.get('dpkg_options', '') -%}
34+
{% set update_days = unattended.get('update_days', '') -%}
35+
1536
Unattended-Upgrade::Allowed-Origins {
1637
{%- for pattern in allowed_origins %}
1738
"{{ pattern }}";
@@ -31,8 +52,20 @@ Unattended-Upgrade::AutoFixInterruptedDpkg "{{ auto_fix_interrupted_dpkg }}";
3152
Unattended-Upgrade::MinimalSteps "{{ minimal_steps }}";
3253
Unattended-Upgrade::InstallOnShutdown "{{ install_on_shutdown }}";
3354
Unattended-Upgrade::Mail "{{ mail }}";
34-
Unattended-Upgrade::MailOnlyOnError "{{ mail_only_on_error }}";
55+
Unattended-Upgrade::Sender "{{ sender }}";
56+
Unattended-Upgrade::MailReport "{{ mail_report }}";
3557
Unattended-Upgrade::Remove-Unused-Dependencies "{{ remove_unused_dependencies }}";
58+
Unattended-Upgrade::Remove-New-Unused-Dependencies "{{ remove_new_unused_dependencies }}";
3659
Unattended-Upgrade::Automatic-Reboot "{{ automatic_reboot }}";
3760
Unattended-Upgrade::Automatic-Reboot-Time "{{ automatic_reboot_time }}";
61+
Unattended-Upgrade::SyslogEnable "{{ syslog_enable }}";
62+
Unattended-Upgrade::SyslogFacility "{{ syslog_facility }}";
63+
Unattended-Upgrade::Keep-Debs-After-Install "{{ keep_debs_after_install }}";
64+
Unattended-Upgrade::Package-Whitelist-Strict "{{ package_whitelist_strict }}";
65+
{% if update_days and update_days | is_list -%}
66+
Unattended-Upgrade::Update-Days {"{{ update_days | join('";"') }}"};
67+
{% endif -%}
3868
Acquire::http::Dl-Limit "{{ dl_limit }}";
69+
{% if dpkg_options -%}
70+
Dpkg::Options {"{{ dpkg_options }}"};
71+
{% endif -%}

‎kitchen.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,3 +85,19 @@ suites:
8585
verifier:
8686
inspec_tests:
8787
- path: test/integration/preferences
88+
- name: unattended
89+
provisioner:
90+
state_top:
91+
base:
92+
'*':
93+
- apt.unattended
94+
pillars:
95+
top.sls:
96+
base:
97+
'*':
98+
- apt
99+
pillars_from_files:
100+
apt.sls: test/salt/pillar/unattended.pillar.sls
101+
verifier:
102+
inspec_tests:
103+
- path: test/integration/unattended

‎pillar.example‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,11 @@ apt:
4848
minimal_steps: false
4949
install_on_shutdown: false
5050
mail: root
51-
mail_only_on_error: false
51+
sender: root
52+
# Prefer using `mail_report: 'only-on-error'` over old syntax,
53+
# mail_only_on_error: false`
54+
# allowed values: 'always', 'only-on-error', 'on-change'
55+
mail_report: 'only-on-error'
5256
remove_unused_dependencies: true
5357
automatic_reboot: false
5458
dl_limit: 0
@@ -58,6 +62,12 @@ apt:
5862
unattended_upgrade: 1
5963
auto_clean_interval: 7
6064
verbose: 2
65+
syslog_enable: true
66+
syslog_facility: 'auth'
67+
dpkg_options: '--force-confold'
68+
update_days: ['Mon', 'Fri']
69+
package_whitelist_strict: false
70+
keep_debs_after_install: false
6171

6272
listchanges:
6373
profiles:
@@ -78,12 +88,14 @@ apt:
7888
comps: [main, contrib, non-free]
7989
arch: [amd64, i386]
8090
type: [binary, source]
91+
key_url: https://ftp-master.debian.org/keys/archive-key-10-security.asc
8192
updates:
8293
distro: stable-updates
8394
url: http://deb.debian.org/debian/
8495
comps: [main, contrib, non-free]
96+
key_url: https://ftp-master.debian.org/keys/archive-key-10.asc
8597
raspbian:
86-
distro: wheezy
98+
distro: stable
8799
url: http://archive.raspbian.org/raspbian
88100
type: [source]
89101
key_url: https://archive.raspbian.org/raspbian.public.key

‎test/integration/unattended/README.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# InSpec Profile: `unattended`
2+
3+
This shows the implementation of the `unattended` InSpec [profile](https://github.com/inspec/inspec/blob/master/docs/profiles.md).
4+
5+
## Verify a profile
6+
7+
InSpec ships with built-in features to verify a profile structure.
8+
9+
```bash
10+
$ inspec check unattended
11+
Summary
12+
-------
13+
Location: unattended
14+
Profile: profile
15+
Controls: 4
16+
Timestamp: 2019-06-24T23:09:01+00:00
17+
Valid: true
18+
19+
Errors
20+
------
21+
22+
Warnings
23+
--------
24+
```
25+
26+
## Execute a profile
27+
28+
To run all **supported** controls on a local machine use `inspec exec /path/to/profile`.
29+
30+
```bash
31+
$ inspec exec unattended
32+
..
33+
34+
Finished in 0.0025 seconds (files took 0.12449 seconds to load)
35+
8 examples, 0 failures
36+
```
37+
38+
## Execute a specific control from a profile
39+
40+
To run one control from the profile use `inspec exec /path/to/profile --controls name`.
41+
42+
```bash
43+
$ inspec exec unattended --controls package
44+
.
45+
46+
Finished in 0.0025 seconds (files took 0.12449 seconds to load)
47+
1 examples, 0 failures
48+
```
49+
50+
See an [example control here](https://github.com/inspec/inspec/blob/master/examples/profile/controls/example.rb).

‎test/integration/unattended/controls/unattended_spec.rb‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# frozen_string_literal: true
2+
3+
audit = command(
4+
"/usr/bin/apt-config dump --no-empty --format '%f=%v%n' Unattended-Upgrade"
5+
).stdout
6+
7+
options = {
8+
assignment_regex: /^\s*([^=]*?)\s*=\s*(.*?)\s*$/,
9+
multiple_values: true
10+
}
11+
12+
control 'Apt unattended upgrades' do
13+
title 'should be configured'
14+
15+
describe file('/etc/apt/apt.conf.d/50unattended-upgrades') do
16+
it { should be_file }
17+
it { should be_owned_by 'root' }
18+
it { should be_grouped_into 'root' }
19+
its('mode') { should cmp '0644' }
20+
end
21+
22+
describe file('/etc/apt/apt.conf.d/10periodic') do
23+
it { should exist }
24+
it { should be_owned_by 'root' }
25+
it { should be_grouped_into 'root' }
26+
its('mode') { should cmp '0644' }
27+
its(:content) do
28+
should match(
29+
'APT::Periodic::Enable "1";'
30+
)
31+
end
32+
end
33+
34+
describe parse_config(audit, options) do
35+
its('Unattended-Upgrade::Allowed-Origins::') { should include 'origin1' }
36+
its('Unattended-Upgrade::Mail') { should include 'root' }
37+
its('Unattended-Upgrade::MailReport') { should include 'only-on-error' }
38+
its('Unattended-Upgrade::Package-Blacklist::') { should include 'salt-test' }
39+
its('Unattended-Upgrade::Automatic-Reboot') { should include 'False' }
40+
its('Unattended-Upgrade::SyslogEnable') { should include 'True' }
41+
its('Unattended-Upgrade::SyslogFacility') { should include 'auth' }
42+
its('Unattended-Upgrade::Remove-Unused-Dependencies') { should include 'True' }
43+
its('Unattended-Upgrade::Keep-Debs-After-Install') { should include 'False' }
44+
its('Unattended-Upgrade::Update-Days::') { should include 'Wed' }
45+
end
46+
end

‎test/integration/unattended/inspec.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# -*- coding: utf-8 -*-
2+
# vim: ft=yaml
3+
---
4+
name: unattended
5+
title: apt formula
6+
maintainer: SaltStack Formulas
7+
license: Apache-2.0
8+
summary: Verify that the apt unattended preferences are configured correctly
9+
supports:
10+
- platform-name: debian
11+
- platform-name: ubuntu

‎test/salt/pillar/unattended.pillar.sls‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# -*- coding: utf-8 -*-
2+
# vim: ft=yaml
3+
---
4+
apt:
5+
unattended:
6+
allowed_origins:
7+
- origin1
8+
package_blacklist:
9+
- salt-test
10+
origins_patterns:
11+
- origin=SaltStack
12+
- origin=Debian,archive=stable,label=Debian-Security
13+
auto_fix_interrupted_dpkg: true
14+
minimal_steps: false
15+
install_on_shutdown: false
16+
mail: root
17+
sender: root
18+
mail_report: 'always'
19+
remove_unused_dependencies: true
20+
automatic_reboot: false
21+
dl_limit: 0
22+
enabled: 1
23+
update_package_lists: 1
24+
download_upgradeable_packages: 1
25+
unattended_upgrade: 1
26+
auto_clean_interval: 7
27+
verbose: 2
28+
syslog_enable: true
29+
syslog_facility: 'auth'
30+
dpkg_options: '--force-confold'
31+
update_days: ['Mon', 'Wed']
32+
package_whitelist_strict: false
33+
keep_debs_after_install: false

0 commit comments

Comments
 (0)