From 88e2bc12d0cee356efe608f508d15b1d260bf855 Mon Sep 17 00:00:00 2001 From: Steven Pritchard Date: Thu, 2 Apr 2026 20:33:21 +0000 Subject: [PATCH 1/3] Remove references to archived SIMP modules Remove all references to the following archived modules: chkrootkit, hirs_provisioner, incron, network, rkhunter, simp_bolt, simp_ipa, simp_openldap, simp_pki_service, sudosh, tcpwrappers, tpm, xinetd This includes removal from metadata.json dependencies, .fixtures.yml, Puppetfiles, manifests, spec tests, hiera data, and acceptance tests as applicable. Co-Authored-By: Claude Opus 4.6 (1M context) --- .fixtures.yml | 5 -- .../one_shot/simp_one_shot_finalize.sh | 3 +- manifests/admin.pp | 30 ++-------- metadata.json | 12 ---- .../suites/default/05_shell_logger_spec.rb | 59 ------------------- .../suites/scenario_one_shot/00_simp_spec.rb | 1 - .../templates/client_hieradata.yaml.erb | 1 - spec/classes/00_classes/admin_spec.rb | 20 ------- 8 files changed, 6 insertions(+), 125 deletions(-) diff --git a/.fixtures.yml b/.fixtures.yml index 5c936af3..fb082922 100644 --- a/.fixtures.yml +++ b/.fixtures.yml @@ -24,7 +24,6 @@ fixtures: augeasproviders_sysctl: https://github.com/simp/augeasproviders_sysctl.git authselect: https://github.com/voxpupuli/puppet-authselect.git autofs: https://github.com/simp/pupmod-simp-autofs.git - chkrootkit: https://github.com/simp/pupmod-simp-chkrootkit.git chrony: https://github.com/simp/pupmod-voxpupuli-chrony.git clamav: https://github.com/simp/pupmod-simp-clamav.git concat: https://github.com/simp/puppetlabs-concat.git @@ -71,7 +70,6 @@ fixtures: simp_apache: https://github.com/simp/pupmod-simp-apache.git simp_banners: https://github.com/simp/pupmod-simp-simp_banners.git simp_firewalld: https://github.com/simp/pupmod-simp-simp_firewalld.git - simp_openldap: https://github.com/simp/pupmod-simp-simp_openldap.git simp_options: https://github.com/simp/pupmod-simp-simp_options.git simp_rsyslog: https://github.com/simp/pupmod-simp-simp_rsyslog.git simp_ds389: https://github.com/simp/pupmod-simp-simp_ds389.git @@ -82,10 +80,8 @@ fixtures: stunnel: https://github.com/simp/pupmod-simp-stunnel.git systemd: https://github.com/simp/puppet-systemd.git sudo: https://github.com/simp/pupmod-simp-sudo.git - sudosh: https://github.com/simp/pupmod-simp-sudosh.git svckill: https://github.com/simp/pupmod-simp-svckill.git swap: https://github.com/simp/pupmod-simp-swap.git - tcpwrappers: https://github.com/simp/pupmod-simp-tcpwrappers.git tftpboot: https://github.com/simp/pupmod-simp-tftpboot.git timezone: https://github.com/simp/pupmod-simp-timezone.git tlog: https://github.com/simp/pupmod-simp-tlog.git @@ -95,7 +91,6 @@ fixtures: vox_selinux: repo: https://github.com/simp/pupmod-voxpupuli-selinux.git branch: simp-master - xinetd: https://github.com/simp/pupmod-simp-xinetd.git yum: https://github.com/simp/voxpupuli-yum.git yumrepo_core: https://github.com/simp/pupmod-puppetlabs-yumrepo_core.git # Kluge for rsync data diff --git a/files/scenarios/one_shot/simp_one_shot_finalize.sh b/files/scenarios/one_shot/simp_one_shot_finalize.sh index 384d57d8..4d35b083 100644 --- a/files/scenarios/one_shot/simp_one_shot_finalize.sh +++ b/files/scenarios/one_shot/simp_one_shot_finalize.sh @@ -91,9 +91,8 @@ else This is a SIMP-based standalone image Some items you should be aware of: - * To get to 'root', you need to use 'sudo sudosh' + * To get to 'root', you need to use 'sudo su - root' * IPTables is *on* - * TCPWrappers is *on* * Host access restriction via PAM is *on* (/etc/security/access.conf) * Password quality restrictions are *enabled* diff --git a/manifests/admin.pp b/manifests/admin.pp index b18b4b3a..eb274ff1 100644 --- a/manifests/admin.pp +++ b/manifests/admin.pp @@ -101,7 +101,7 @@ Simplib::Netlist $admins_allowed_from = ['ALL'], Simplib::Netlist $auditors_allowed_from = simplib::lookup('simp_options::trusted_nets', { 'default_value' => ['127.0.0.1'] }), Boolean $force_logged_shell = true, - Enum['sudosh','tlog'] $logged_shell = 'tlog', + Enum['tlog'] $logged_shell = 'tlog', Array[String[2]] $default_admin_sudo_cmnds = ['/bin/su - root'], Hash $admin_sudo_options = { 'role' => 'unconfined_r' }, Hash $auditor_sudo_options = {}, @@ -144,35 +144,15 @@ } if $force_logged_shell { - # We restrict this so we don't need a fallback - if $logged_shell == 'sudosh' { - include 'sudosh' + include 'tlog::rec_session' - $_shell_cmd = ['/usr/bin/sudosh'] - } - else { - # TODO: This should be removed when SIMP-5169 is resolved - file { '/etc/profile.d/sudosh2.sh': ensure => 'absent' } - } - - if $logged_shell == 'tlog' { - include 'tlog::rec_session' + $_shell_cmd = $default_admin_sudo_cmnds - $_shell_cmd = $default_admin_sudo_cmnds - } - else { - # TODO: This should be removed when SIMP-5169 is resolved - tidy { 'Tlog profile.d files': - path => '/etc/profile.d', - matches => ['00-simp-tlog.*'], - recurse => 1, - } - } + file { '/etc/profile.d/sudosh2.sh': ensure => 'absent' } } else { $_shell_cmd = $default_admin_sudo_cmnds - # TODO: These should be removed when SIMP-5169 is resolved tidy { 'Shell logging profile.d files': path => '/etc/profile.d', matches => ['00-simp-tlog.*', 'sudosh2.*'], @@ -198,7 +178,7 @@ } } - # The following two are especially important if you're using sudosh. + # The following two are especially important for logged shell recovery. # They allow you to recover from destroying the certs in your environment. sudo::user_specification { 'admin run puppet': user_list => ["%${admin_group}"], diff --git a/metadata.json b/metadata.json index a4a9dd8e..0568ec65 100644 --- a/metadata.json +++ b/metadata.json @@ -55,10 +55,6 @@ "name": "simp/auditd", "version_requirement": ">= 8.5.0 < 11.0.0" }, - { - "name": "simp/chkrootkit", - "version_requirement": ">= 0.1.0 < 1.0.0" - }, { "name": "simp/clamav", "version_requirement": ">= 6.0.0 < 8.0.0" @@ -119,10 +115,6 @@ "name": "simp/simp_apache", "version_requirement": ">= 7.0.0 < 9.0.0" }, - { - "name": "simp/simp_openldap", - "version_requirement": ">= 6.0.0 < 7.0.0" - }, { "name": "simp/simp_options", "version_requirement": ">= 1.6.1 < 3.0.0" @@ -151,10 +143,6 @@ "name": "simp/sudo", "version_requirement": ">= 5.1.1 < 7.0.0" }, - { - "name": "simp/sudosh", - "version_requirement": ">= 6.1.0 < 7.0.0" - }, { "name": "simp/svckill", "version_requirement": ">= 3.6.1 < 5.0.0" diff --git a/spec/acceptance/suites/default/05_shell_logger_spec.rb b/spec/acceptance/suites/default/05_shell_logger_spec.rb index 6a97360b..1b876595 100644 --- a/spec/acceptance/suites/default/05_shell_logger_spec.rb +++ b/spec/acceptance/suites/default/05_shell_logger_spec.rb @@ -26,65 +26,6 @@ end end - os_major = fact_on(host, 'os.release.major') - - if os_major == '7' - context 'switching to sudosh' do - let(:hieradata) do - YAML.load_file(File.expand_path('files/default_hiera.yaml', __dir__)).merge( - 'simp::admin::logged_shell' => 'sudosh', - ) - end - - it 'switches to sudosh via hiera' do - set_hieradata_on(host, hieradata) - end - - it 'runs puppet' do - apply_manifest_on(host, manifest, catch_changes: false) - end - - it 'is idempotent' do - apply_manifest_on(host, manifest, catch_changes: true) - end - - it 'has sudosh2 installed' do - expect(host.check_for_package('sudosh2')).to be true - end - - it 'does not have any tlog profile scripts installed' do - expect(on(host, 'ls /etc/profile.d/00-simp-tlog.*', accept_all_exit_codes: true).stdout.strip).to be_empty - end - end - - context 'switching back to tlog' do - let(:hieradata) do - YAML.load_file(File.expand_path('files/default_hiera.yaml', __dir__)).merge( - 'simp::admin::logged_shell' => 'tlog', - ) - end - - it 'switches back to tlog via hiera' do - set_hieradata_on(host, hieradata) - end - - it 'runs puppet' do - apply_manifest_on(host, manifest, catch_changes: false) - end - - it 'is idempotent' do - apply_manifest_on(host, manifest, catch_changes: true) - end - - it 'has tlog installed' do - expect(host.check_for_package('sudosh2')).to be true - end - - it 'does not have any sudosh profile scripts installed' do - expect(on(host, 'ls /etc/profile.d/sudosh*', accept_all_exit_codes: true).stdout.strip).to be_empty - end - end - end end end end diff --git a/spec/acceptance/suites/scenario_one_shot/00_simp_spec.rb b/spec/acceptance/suites/scenario_one_shot/00_simp_spec.rb index ebe3965c..7b44052a 100644 --- a/spec/acceptance/suites/scenario_one_shot/00_simp_spec.rb +++ b/spec/acceptance/suites/scenario_one_shot/00_simp_spec.rb @@ -64,7 +64,6 @@ def wait_for_finalize(host, timeout = 500) simp_options::pam: true simp_options::sssd: true simp_options::syslog: true - simp_options::tcpwrappers: true simp_options::pki: true simp_options::sssd: true diff --git a/spec/acceptance/suites/scenario_remote_access/templates/client_hieradata.yaml.erb b/spec/acceptance/suites/scenario_remote_access/templates/client_hieradata.yaml.erb index f297df89..32de3d70 100644 --- a/spec/acceptance/suites/scenario_remote_access/templates/client_hieradata.yaml.erb +++ b/spec/acceptance/suites/scenario_remote_access/templates/client_hieradata.yaml.erb @@ -21,7 +21,6 @@ simp_options::pam: true simp_options::sssd: true simp_options::stunnel: false simp_options::syslog: false -simp_options::tcpwrappers: false simp_options::ipsec: false simp_options::kerberos: false diff --git a/spec/classes/00_classes/admin_spec.rb b/spec/classes/00_classes/admin_spec.rb index 8e1509ad..893124b3 100644 --- a/spec/classes/00_classes/admin_spec.rb +++ b/spec/classes/00_classes/admin_spec.rb @@ -87,7 +87,6 @@ end it { is_expected.to create_class('tlog::rec_session') } - it { is_expected.not_to create_class('sudosh') } it { is_expected.to create_sudo__user_specification('admin global').with( @@ -98,25 +97,6 @@ } end - context 'when setting sudosh as the logged shell' do - let(:params) do - { - logged_shell: 'sudosh', - } - end - - it { is_expected.to create_class('sudosh') } - it { is_expected.not_to create_class('tlog::rec_session') } - - it { - is_expected.to create_sudo__user_specification('admin global').with( - user_list: ['%administrators'], - cmnd: ['/usr/bin/sudosh'], - passwd: false, - ) - } - end - context 'with admin and auditor settings' do let(:params) do { From 866b7ebe9870bd308bc4bb2eef07bd35b38e4593 Mon Sep 17 00:00:00 2001 From: Steven Pritchard Date: Wed, 29 Jul 2026 22:18:13 +0000 Subject: [PATCH 2/3] Add CHANGELOG entry for the archived-module removal Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01XCnDsYaJDLiP8z8tafz9Tp --- CHANGELOG | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGELOG b/CHANGELOG index a396372a..52f5891e 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,9 @@ +* Wed Jul 29 2026 Steven Pritchard - 9.0.0 +- Remove references to archived SIMP modules (sudosh, tcpwrappers, xinetd, + chkrootkit, simp_openldap): drop their fixtures and metadata dependencies +- BREAKING CHANGE: `simp::admin::logged_shell` no longer accepts `sudosh`; + `tlog` is the only supported logged shell + * Wed Jul 29 2026 Hazel Caballero - 9.0.0 - (#374) Remove all references to the archived pupmod-simp-ntpd module: drop the `simp/ntpd` metadata dependency and fixture, consolidate the kickstart From 178d298d3d509ee1aa3247f5e25cf686a4effa61 Mon Sep 17 00:00:00 2001 From: Steven Pritchard Date: Wed, 29 Jul 2026 22:38:36 +0000 Subject: [PATCH 3/3] Fix rubocop offense in shell_logger spec Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01XCnDsYaJDLiP8z8tafz9Tp --- spec/acceptance/suites/default/05_shell_logger_spec.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/spec/acceptance/suites/default/05_shell_logger_spec.rb b/spec/acceptance/suites/default/05_shell_logger_spec.rb index 1b876595..ff592d52 100644 --- a/spec/acceptance/suites/default/05_shell_logger_spec.rb +++ b/spec/acceptance/suites/default/05_shell_logger_spec.rb @@ -25,7 +25,6 @@ expect(host.check_for_package('tlog')).to be true end end - end end end