mirror of
https://github.com/ansible-collections/ansible.posix.git
synced 2026-06-09 18:15:54 +00:00
714c50bdb7
Fixes #462 notice permission denied on authorized_key module
SUMMARY
As of right now the authorized_key module does not notice on an "absent" if a authorized_keys file is simply not readable to the executing user. I am trying to fix that
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
authorized_key
ADDITIONAL INFORMATION
Execute as a user that does not have access to the root users authorized keys file
- name: Delete key from root user
ansible.posix.authorized_key:
state: absent
user: root
key: ssh-rsa xxxxxxxx
- name: Delete key from root user
become: true
ansible.posix.authorized_key:
state: absent
user: root
key: ssh-rsa xxxxxxxx
The one without become will succeed before my change and will fail with a permission denied error after my change. The 2nd task will actually remove a key from root user if become privileges are available for the executing user
Reviewed-by: Brian Coca
Reviewed-by: Klaas Demter
Reviewed-by: Felix Fontein <felix@fontein.de>
Reviewed-by: Hideki Saito <saito@fgrep.org>
(cherry picked from commit 72a6eb9729)
Co-authored-by: softwarefactory-project-zuul[bot] <33884098+softwarefactory-project-zuul[bot]@users.noreply.github.com>
42 lines
970 B
YAML
42 lines
970 B
YAML
---
|
|
# -------------------------------------------------------------
|
|
# check permissions
|
|
|
|
- name: Create a file that is not accessible
|
|
ansible.builtin.file:
|
|
state: touch
|
|
path: "{{ output_dir | expanduser }}/file_permissions"
|
|
owner: root
|
|
mode: '0000'
|
|
|
|
- name: Create unprivileged user
|
|
ansible.builtin.user:
|
|
name: nopriv
|
|
create_home: true
|
|
|
|
- name: Try to delete a key from an unreadable file
|
|
become: true
|
|
become_user: nopriv
|
|
ansible.posix.authorized_key:
|
|
user: root
|
|
key: "{{ dss_key_basic }}"
|
|
state: absent
|
|
path: "{{ output_dir | expanduser }}/file_permissions"
|
|
register: result
|
|
ignore_errors: true
|
|
|
|
- name: Assert that the key deletion has failed
|
|
ansible.builtin.assert:
|
|
that:
|
|
- result is failed
|
|
|
|
- name: Remove the file
|
|
ansible.builtin.file:
|
|
state: absent
|
|
path: "{{ output_dir | expanduser }}/file_permissions"
|
|
|
|
- name: Remove the user
|
|
ansible.builtin.user:
|
|
name: nopriv
|
|
state: absent
|