ansible-collections/community.general
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2025-05-14 21:19:12 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

Add a umask argument to run_command

Browse source 
In order to avoid problem due to race conditions, it is
required to run umask when generating some sensitive files,
such as a TLS key.
This commit is contained in:
Michael Scherer 2016-09-24 18:29:15 +02:00 • committed by Brian Coca
parent 38b975800d
commit 362b682f1c
1 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
lib/ansible/module_utils/basic.py
View file

@ -2030,7 +2030,7 @@ class AnsibleModule(object):
else: else:
self.fail_json(msg='Could not replace file: %s to %s: %s' % (src, dest, exception)) self.fail_json(msg='Could not replace file: %s to %s: %s' % (src, dest, exception))
def run_command(self, args, check_rc=False, close_fds=True, executable=None, data=None, binary_data=False, path_prefix=None, cwd=None, use_unsafe_shell=False, prompt_regex=None, environ_update=None): def run_command(self, args, check_rc=False, close_fds=True, executable=None, data=None, binary_data=False, path_prefix=None, cwd=None, use_unsafe_shell=False, prompt_regex=None, environ_update=None, umask=None):
''' '''
Execute a command, returns rc, stdout, and stderr. Execute a command, returns rc, stdout, and stderr.
@ -2053,6 +2053,7 @@ class AnsibleModule(object):
used to detect prompts in the stdout which would otherwise cause used to detect prompts in the stdout which would otherwise cause
the execution to hang (especially if no input data is specified) the execution to hang (especially if no input data is specified)
:kwarg environ_update: dictionary to *update* os.environ with :kwarg environ_update: dictionary to *update* os.environ with
:kw umask: Umask to be used when running the command. Default None
''' '''
shell = False shell = False
@ -2180,6 +2181,10 @@ class AnsibleModule(object):
e = get_exception() e = get_exception()
self.fail_json(rc=e.errno, msg="Could not open %s, %s" % (cwd, str(e))) self.fail_json(rc=e.errno, msg="Could not open %s, %s" % (cwd, str(e)))
old_umask = None
if umask:
old_umask = os.umask(umask)
try: try:
if self._debug: if self._debug:
@ -2253,6 +2258,9 @@ class AnsibleModule(object):
else: else:
os.environ[key] = val os.environ[key] = val
if old_umask:
os.umask(old_umask)
if rc != 0 and check_rc: if rc != 0 and check_rc:
msg = heuristic_log_sanitize(stderr.rstrip(), self.no_log_values) msg = heuristic_log_sanitize(stderr.rstrip(), self.no_log_values)
self.fail_json(cmd=clean_args, rc=rc, stdout=stdout, stderr=stderr, msg=msg) self.fail_json(cmd=clean_args, rc=rc, stdout=stdout, stderr=stderr, msg=msg)