Nexus Agent
84b388fae2
文件推送与文件管理对齐：非 root 默认 auto_sudo 时使用 sudo -n rsync； 新增批量 sudoers 补丁脚本以补全 rsync 白名单。
38 lines
1.3 KiB
Python
38 lines
1.3 KiB
Python
"""Rsync remote receiver elevation — mirrors ``files_elevation`` for file push.
|
|
|
|
Policy (same as file manager): **root** SSH → no sudo; **non-root** with default
|
|
``auto_sudo`` (or ``always_sudo``) → ``sudo -n rsync`` on the receiver.
|
|
Only ``files_elevation=off`` disables elevation.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from server.domain.models import Server
|
|
from server.utils.files_elevation import FilesElevation, get_files_elevation
|
|
|
|
# Fixed remote receiver command (no user input); requires NOPASSWD rsync in sudoers.
|
|
RSYNC_SUDO_RECEIVER_PATH = "sudo -n rsync"
|
|
|
|
|
|
def is_root_ssh_user(server: Server) -> bool:
|
|
ssh_user = (server.username or "root").strip() or "root"
|
|
return ssh_user == "root"
|
|
|
|
|
|
def rsync_receiver_path_for_push(server: Server) -> str | None:
|
|
"""Return ``--rsync-path`` for non-root servers when elevation is enabled."""
|
|
if is_root_ssh_user(server):
|
|
return None
|
|
if get_files_elevation(server) == FilesElevation.OFF:
|
|
return None
|
|
return RSYNC_SUDO_RECEIVER_PATH
|
|
|
|
|
|
def rsync_elevation_log_hint(server: Server) -> str | None:
|
|
"""Short tag for sync_logs.push_permission."""
|
|
if is_root_ssh_user(server):
|
|
return None
|
|
if get_files_elevation(server) == FilesElevation.OFF:
|
|
return None
|
|
return "rsync=sudo"
|