Fixes the symlink handling issue in the authorized_key module (#760) (#762)

- Addresses CVE-2026-11837
- Fixes #759

Signed-off-by: Hideki Saito <saito@fgrep.org>

plugins/modules/authorized_key.py

@@ -307,6 +307,17 @@ class keydict(dict):
         return [item[1] for item in self.items()]
 
 
+def _safe_open_write(module, path, follow):
+    flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
+    if not follow and hasattr(os, 'O_NOFOLLOW'):
+        flags |= os.O_NOFOLLOW
+    try:
+        fd = os.open(path, flags, int('0600', 8))
+    except OSError as e:
+        module.fail_json(msg="File open failed %s : %s" % (path, to_native(e)))
+    return fd
+
+
 def keyfile(module, user, write=False, path=None, manage_dir=True, follow=False):
     """
     Calculate name of authorized keys file, optionally creating the
@@ -359,7 +370,7 @@ def keyfile(module, user, write=False, path=None, manage_dir=True, follow=False)
                 module.fail_json(msg="Failed to create directory %s : %s" % (sshdir, to_native(e)))
             if module.selinux_enabled():
                 module.set_default_selinux_context(sshdir, False)
-        os.chown(sshdir, uid, gid)
+        os.chown(sshdir, uid, gid, follow_symlinks=follow)
         os.chmod(sshdir, int('0700', 8))
 
     if not os.path.exists(keysfile):
@@ -367,16 +378,13 @@ def keyfile(module, user, write=False, path=None, manage_dir=True, follow=False)
         if not os.path.exists(basedir):
             os.makedirs(basedir)
 
-        f = None
-        try:
-            f = open(keysfile, "w")  # touches file so we can set ownership and perms
-        finally:
-            f.close()
+        fd = _safe_open_write(module, keysfile, follow)
+        os.close(fd)
         if module.selinux_enabled():
             module.set_default_selinux_context(keysfile, False)
 
     try:
-        os.chown(keysfile, uid, gid)
+        os.chown(keysfile, uid, gid, follow_symlinks=follow)
         os.chmod(keysfile, int('0600', 8))
     except OSError:
         pass
@@ -607,7 +615,7 @@ def enforce_state(module, params):
 
     # check current state -- just get the filename, don't create file
     do_write = False
-    params["keyfile"] = keyfile(module, user, do_write, path, manage_dir)
+    params["keyfile"] = keyfile(module, user, do_write, path, manage_dir, follow)
     existing_content = readfile(module, params["keyfile"])
     existing_keys = parsekeys(module, existing_content)
 
@@ -696,6 +704,11 @@ def enforce_state(module, params):
 
         if not module.check_mode:
             writefile(module, filename, new_content)
+            user_entry = pwd.getpwnam(user)
+            uid = user_entry.pw_uid
+            gid = user_entry.pw_gid
+            os.chown(filename, uid, gid, follow_symlinks=follow)
+            os.chmod(filename, int('0600', 8))
         params['changed'] = True
 
     return params