KDE

roles/sudo-dom0-prompt/tasks/main.yaml

@@ -0,0 +1,51 @@
+- name: Setup passwordless sudo
+  hosts: 127.0.0.1
+  connection: local
+  tasks:
+   - name: Check that the sudo-dom0-prompt exists
+     stat:
+       path: '/etc/authselect/custom/sudo-dom0-prompt'
+     register: stat_result
+
+   - name: Create authselect profile
+     shell: authselect create-profile sudo-dom0-prompt --base-on=sssd --symlink-meta --symlink-pam
+     when: not stat_result.stat.exists
+   - name: Copy authselect file
+     ansible.builtin.copy:
+      src: '/etc/authselect/custom/sudo-dom0-prompt/system-auth'
+      dest: '/etc/authselect/custom/sudo-dom0-prompt/system-auth.original_aside'
+      mode: '0644'
+
+   - name: Copy authselect folder
+     ansible.builtin.copy:
+      src: '/etc/authselect/system-auth'
+      dest: '/etc/authselect/custom/sudo-dom0-prompt'
+      mode: '0755'
+
+   - name: Copy authselect file
+     ansible.builtin.copy:
+      src: 'etc/authselect/custom/sudo-dom0-prompt/system-auth'
+      dest: '/etc/authselect/custom/sudo-dom0-prompt/system-auth'
+      mode: '0644'
+
+
+   - name: Select authselect profile
+     shell: authselect select custom/sudo-dom0-prompt
+
+   - name: Fix sudoers.d
+     ansible.builtin.copy:
+      src: 'etc/sudoers.d/qubes'
+      dest: '/etc/sudoers.d/qubes'
+      mode: '0440'
+
+   - name: Check that allow all rule doesn't exist
+     stat:
+       path: '/etc/polkit-1/rules.d/00-qubes-allow-all.rules'
+     register: allow_all_result
+
+   - name: Delete allow all rule
+     ansible.builtin.file:
+      path: '/etc/polkit-1/rules.d/00-qubes-allow-all.rules'
+      state: 'absent'
+     when: allow_all_result.stat.exists
+