git: 7508443b1604 - stable/14 - nuageinit: enhance sudo support

The branch stable/14 has been updated by bapt:

URL: https://cgit.FreeBSD.org/src/commit/?id=7508443b1604bf1adae99f866770deac1bcdce29

commit 7508443b1604bf1adae99f866770deac1bcdce29
Author:     Baptiste Daroussin <bapt@FreeBSD.org>
AuthorDate: 2025-06-26 12:32:27 +0000
Commit:     Baptiste Daroussin <bapt@FreeBSD.org>
CommitDate: 2025-07-08 14:31:47 +0000

    nuageinit: enhance sudo support
    
    from the cloudinit specification sudo rules can be a string or an
    array of string
    
    (cherry picked from commit b56d2195f124d48ce54369d179aa1d4663e5e64a)
---
 libexec/nuageinit/nuage.lua          | 8 +++++++-
 libexec/nuageinit/nuageinit.7        | 2 +-
 libexec/nuageinit/tests/nuageinit.sh | 8 +++++++-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/libexec/nuageinit/nuage.lua b/libexec/nuageinit/nuage.lua
index cdc0fc6cf2a7..161b95c60d56 100644
--- a/libexec/nuageinit/nuage.lua
+++ b/libexec/nuageinit/nuage.lua
@@ -287,7 +287,13 @@ local function addsudo(pwd)
 		warnmsg("impossible to open " .. sudoers)
 		return
 	end
-	f:write(pwd.name .. " " .. pwd.sudo .. "\n")
+	if type(pwd.sudo) == "string" then
+		f:write(pwd.name .. " " .. pwd.sudo .. "\n")
+	elseif type(pwd.sudo) == "table" then
+		for _, str in ipairs(pwd.sudo) do
+			f:write(pwd.name .. " " .. str .. "\n")
+		end
+	end
 	f:close()
 	if chmodsudoers then
 		sys_stat.chmod(sudoers, 416)
diff --git a/libexec/nuageinit/nuageinit.7 b/libexec/nuageinit/nuageinit.7
index 3bb440ebac95..327ce160e151 100644
--- a/libexec/nuageinit/nuageinit.7
+++ b/libexec/nuageinit/nuageinit.7
@@ -211,7 +211,7 @@ The list of other groups the user should belong to.
 .It Ic locked
 Boolean to determine if the user account should be locked.
 .It Ic sudo
-An entry which should be appended to
+A string or an array of strings which which should be appended to
 .Pa /usr/local/etc/sudoers.d/90-nuageinit-users
 .El
 .Pp
diff --git a/libexec/nuageinit/tests/nuageinit.sh b/libexec/nuageinit/tests/nuageinit.sh
index 639c87181f95..849f1c258b62 100644
--- a/libexec/nuageinit/tests/nuageinit.sh
+++ b/libexec/nuageinit/tests/nuageinit.sh
@@ -121,6 +121,10 @@ users:
     sudo: ALL=(ALL) NOPASSWD:ALL
     groups: users
     passwd: $6$j212wezy$7H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/
+  - name: bla
+    sudo:
+    - "ALL=(ALL) NOPASSWD:/usr/sbin/pw"
+    - "ALL=(ALL) ALL"
 EOF
 	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit nocloud
 	atf_check /usr/libexec/nuageinit "${PWD}"/media/nuageinit postnet
@@ -131,17 +135,19 @@ admingroup:*:1001:root,sys
 cloud-users:*:1002:
 freebsd:*:1003:
 foobar:*:1004:
+bla:*:1005:
 EOF
 	cat > expectedpasswd << 'EOF'
 root:*:0:0::0:0:Charlie &:/root:/bin/sh
 sys:*:1:0::0:0:Sys:/home/sys:/bin/sh
 freebsd:freebsd:1001:1003::0:0:FreeBSD User:/home/freebsd:/bin/sh
 foobar:$6$j212wezy$7H/1LT4f9/N3wpgNunhsIqtMj62OKiS3nyNwuizouQc3u7MbYCarYeAHWYPYb2FT.lbioDm2RrkJPb9BZMN1O/:1002:1004::0:0:Foo B. Bar:/home/foobar:/bin/sh
+bla::1003:1005::0:0:bla User:/home/bla:/bin/sh
 EOF
 	sed -i "" "s/freebsd:.*:1001/freebsd:freebsd:1001/" "${PWD}"/etc/master.passwd
 	atf_check -o file:expectedpasswd cat "${PWD}"/etc/master.passwd
 	atf_check -o file:expectedgroup cat "${PWD}"/etc/group
-	atf_check -o inline:"foobar ALL=(ALL) NOPASSWD:ALL\n" cat ${PWD}/usr/local/etc/sudoers.d/90-nuageinit-users
+	atf_check -o inline:"foobar ALL=(ALL) NOPASSWD:ALL\nbla ALL=(ALL) NOPASSWD:/usr/sbin/pw\nbla ALL=(ALL) ALL\n" cat ${PWD}/usr/local/etc/sudoers.d/90-nuageinit-users
 }
 
 nocloud_network_head()