Remove role lmn_teacherlaptop and extend role lmn_security

- Add variable to configure sudo-program permissions (`sudo_permissions`)
- Add variable to configure polkit-rules (`polkit_rules`)
- Migrate sudo and polkit permissions from lmn_teacherlaptop role to inventory

roles/lmn_security/handlers/main.yml

@@ -3,3 +3,8 @@
     name: sshd
     state: reloaded
   when: not run_in_installer|default(false)|bool
+
+- name: Restart polkit
+  ansible.builtin.systemd:
+    name: polkit
+    state: restarted

roles/lmn_security/tasks/main.yml

@@ -28,3 +28,21 @@
       PasswordAuthentication no
       AllowUsers ansible
   notify: Reload sshd
+
+- name: Deploy sudo configurations
+  ansible.builtin.copy:
+    dest: /etc/sudoers.d/90-lmn-security
+    owner: root
+    group: root
+    mode: '0700'
+    content: |
+      {% for user, programs in sudo_permissions.items() %}
+      {{ user }} ALL=(root) NOPASSWD: {% for program in programs %}{{ program }}{% if not loop.last %}, {% endif %}{% endfor %}
+      {% endfor %}
+
+- name: Deploy polkit configurations
+  ansible.builtin.template:
+    src: polkit_rules.j2
+    dest: /etc/polkit-1/rules.d/lmn-security.rules
+    mode: '0644'
+  notify: Restart polkit

roles/lmn_security/templates/polkit_rules.j2

@@ -0,0 +1,12 @@
+// /etc/polkit-1/rules.d/lmn-security.rules
+
+polkit.addRule(function(action, subject) {
+{% for group, privlist in polkit_rules.items() %}
+    if (subject.isInGroup("{{ group }}")){
+    {% for priv in privlist %}
+        if (action.id == "{{ priv }}") { return polkit.Result.YES; }
+    {% endfor %}
+    }
+{% endfor %}
+});
+