mirror of
https://github.com/ansible-collections/community.general.git
synced 2025-07-02 14:40:19 -07:00
preliminary privlege escalation unification + pbrun
- become constants inherit existing sudo/su ones - become command line options, marked sudo/su as deprecated and moved sudo/su passwords to runas group - changed method signatures as privlege escalation is collapsed to become - added tests for su and become, diabled su for lack of support in local.py - updated playbook,play and task objects to become - added become to runner - added whoami test for become/sudo/su - added home override dir for plugins - removed useless method from ask pass - forced become pass to always be string also uses to_bytes - fixed fakerunner for tests - corrected reference in synchronize action plugin - added pfexec (needs testing) - removed unused sudo/su in runner init - removed deprecated info - updated pe tests to allow to run under sudo and not need root - normalized become options into a funciton to avoid duplication and inconsistencies - pushed suppored list to connection classs property - updated all connection plugins to latest 'become' pe - includes fixes from feedback (including typos) - added draft docs - stub of become_exe, leaving for future v2 fixes
This commit is contained in:
Brian Coca
parent
17c710e713
commit
5f6db0e164
45 changed files with 841 additions and 472 deletions
|
|
@ -32,24 +32,25 @@ import uuid
|
|||
|
||||
class Play(object):
|
||||
|
||||
__slots__ = [
|
||||
'hosts', 'name', 'vars', 'vars_file_vars', 'role_vars', 'default_vars', 'vars_prompt', 'vars_files',
|
||||
'handlers', 'remote_user', 'remote_port', 'included_roles', 'accelerate',
|
||||
'accelerate_port', 'accelerate_ipv6', 'sudo', 'sudo_user', 'transport', 'playbook',
|
||||
'tags', 'gather_facts', 'serial', '_ds', '_handlers', '_tasks',
|
||||
'basedir', 'any_errors_fatal', 'roles', 'max_fail_pct', '_play_hosts', 'su', 'su_user',
|
||||
'vault_password', 'no_log', 'environment',
|
||||
_pb_common = [
|
||||
'accelerate', 'accelerate_ipv6', 'accelerate_port', 'any_errors_fatal', 'become',
|
||||
'become_method', 'become_user', 'environment', 'gather_facts', 'handlers', 'hosts',
|
||||
'name', 'no_log', 'remote_user', 'roles', 'serial', 'su', 'su_user', 'sudo',
|
||||
'sudo_user', 'tags', 'vars', 'vars_files', 'vars_prompt', 'vault_password',
|
||||
]
|
||||
|
||||
__slots__ = _pb_common + [
|
||||
'_ds', '_handlers', '_play_hosts', '_tasks', 'any_errors_fatal', 'basedir',
|
||||
'default_vars', 'included_roles', 'max_fail_pct', 'playbook', 'remote_port',
|
||||
'role_vars', 'transport', 'vars_file_vars',
|
||||
]
|
||||
|
||||
# to catch typos and so forth -- these are userland names
|
||||
# and don't line up 1:1 with how they are stored
|
||||
VALID_KEYS = frozenset((
|
||||
'hosts', 'name', 'vars', 'vars_prompt', 'vars_files',
|
||||
'tasks', 'handlers', 'remote_user', 'user', 'port', 'include', 'accelerate', 'accelerate_port', 'accelerate_ipv6',
|
||||
'sudo', 'sudo_user', 'connection', 'tags', 'gather_facts', 'serial',
|
||||
'any_errors_fatal', 'roles', 'role_names', 'pre_tasks', 'post_tasks', 'max_fail_percentage',
|
||||
'su', 'su_user', 'vault_password', 'no_log', 'environment',
|
||||
))
|
||||
VALID_KEYS = frozenset(_pb_common + [
|
||||
'connection', 'include', 'max_fail_percentage', 'port', 'post_tasks',
|
||||
'pre_tasks', 'role_names', 'tasks', 'user',
|
||||
])
|
||||
|
||||
# *************************************************
|
||||
|
||||
|
|
@ -58,7 +59,7 @@ class Play(object):
|
|||
|
||||
for x in ds.keys():
|
||||
if not x in Play.VALID_KEYS:
|
||||
raise errors.AnsibleError("%s is not a legal parameter at this level in an Ansible Playbook" % x)
|
||||
raise errors.AnsibleError("%s is not a legal parameter of an Ansible Play" % x)
|
||||
|
||||
# allow all playbook keys to be set by --extra-vars
|
||||
self.vars = ds.get('vars', {})
|
||||
|
|
@ -140,8 +141,6 @@ class Play(object):
|
|||
self._handlers = ds.get('handlers', [])
|
||||
self.remote_user = ds.get('remote_user', ds.get('user', self.playbook.remote_user))
|
||||
self.remote_port = ds.get('port', self.playbook.remote_port)
|
||||
self.sudo = ds.get('sudo', self.playbook.sudo)
|
||||
self.sudo_user = ds.get('sudo_user', self.playbook.sudo_user)
|
||||
self.transport = ds.get('connection', self.playbook.transport)
|
||||
self.remote_port = self.remote_port
|
||||
self.any_errors_fatal = utils.boolean(ds.get('any_errors_fatal', 'false'))
|
||||
|
|
@ -149,22 +148,40 @@ class Play(object):
|
|||
self.accelerate_port = ds.get('accelerate_port', None)
|
||||
self.accelerate_ipv6 = ds.get('accelerate_ipv6', False)
|
||||
self.max_fail_pct = int(ds.get('max_fail_percentage', 100))
|
||||
self.su = ds.get('su', self.playbook.su)
|
||||
self.su_user = ds.get('su_user', self.playbook.su_user)
|
||||
self.no_log = utils.boolean(ds.get('no_log', 'false'))
|
||||
|
||||
# Fail out if user specifies conflicting privelege escalations
|
||||
if (ds.get('become') or ds.get('become_user')) and (ds.get('sudo') or ds.get('sudo_user')):
|
||||
raise errors.AnsibleError('sudo params ("become", "become_user") and su params ("sudo", "sudo_user") cannot be used together')
|
||||
if (ds.get('become') or ds.get('become_user')) and (ds.get('su') or ds.get('su_user')):
|
||||
raise errors.AnsibleError('sudo params ("become", "become_user") and su params ("su", "su_user") cannot be used together')
|
||||
if (ds.get('sudo') or ds.get('sudo_user')) and (ds.get('su') or ds.get('su_user')):
|
||||
raise errors.AnsibleError('sudo params ("sudo", "sudo_user") and su params ("su", "su_user") cannot be used together')
|
||||
|
||||
# become settings are inherited and updated normally
|
||||
self.become = ds.get('become', self.playbook.become)
|
||||
self.become_method = ds.get('become_method', self.playbook.become_method)
|
||||
self.become_user = ds.get('become_user', self.playbook.become_user)
|
||||
|
||||
# Make sure current play settings are reflected in become fields
|
||||
if 'sudo' in ds:
|
||||
self.become=ds['sudo']
|
||||
self.become_method='sudo'
|
||||
if 'sudo_user' in ds:
|
||||
self.become_user=ds['sudo_user']
|
||||
elif 'su' in ds:
|
||||
self.become=True
|
||||
self.become=ds['su']
|
||||
if 'su_user' in ds:
|
||||
self.become_user=ds['su_user']
|
||||
|
||||
# gather_facts is not a simple boolean, as None means that a 'smart'
|
||||
# fact gathering mode will be used, so we need to be careful here as
|
||||
# calling utils.boolean(None) returns False
|
||||
self.gather_facts = ds.get('gather_facts', None)
|
||||
if self.gather_facts:
|
||||
if self.gather_facts is not None:
|
||||
self.gather_facts = utils.boolean(self.gather_facts)
|
||||
|
||||
# Fail out if user specifies a sudo param with a su param in a given play
|
||||
if (ds.get('sudo') or ds.get('sudo_user')) and (ds.get('su') or ds.get('su_user')):
|
||||
raise errors.AnsibleError('sudo params ("sudo", "sudo_user") and su params '
|
||||
'("su", "su_user") cannot be used together')
|
||||
|
||||
load_vars['role_names'] = ds.get('role_names', [])
|
||||
|
||||
self._tasks = self._load_tasks(self._ds.get('tasks', []), load_vars)
|
||||
|
|
@ -173,9 +190,6 @@ class Play(object):
|
|||
# apply any missing tags to role tasks
|
||||
self._late_merge_role_tags()
|
||||
|
||||
if self.sudo_user != 'root':
|
||||
self.sudo = True
|
||||
|
||||
# place holder for the discovered hosts to be used in this play
|
||||
self._play_hosts = None
|
||||
|
||||
|
|
@ -429,7 +443,7 @@ class Play(object):
|
|||
|
||||
for (role, role_path, role_vars, role_params, default_vars) in roles:
|
||||
# special vars must be extracted from the dict to the included tasks
|
||||
special_keys = [ "sudo", "sudo_user", "when", "with_items" ]
|
||||
special_keys = [ "sudo", "sudo_user", "when", "with_items", "su", "su_user", "become", "become_user" ]
|
||||
special_vars = {}
|
||||
for k in special_keys:
|
||||
if k in role_vars:
|
||||
|
|
@ -531,7 +545,7 @@ class Play(object):
|
|||
|
||||
# *************************************************
|
||||
|
||||
def _load_tasks(self, tasks, vars=None, role_params=None, default_vars=None, sudo_vars=None,
|
||||
def _load_tasks(self, tasks, vars=None, role_params=None, default_vars=None, become_vars=None,
|
||||
additional_conditions=None, original_file=None, role_name=None):
|
||||
''' handle task and handler include statements '''
|
||||
|
||||
|
|
@ -547,8 +561,8 @@ class Play(object):
|
|||
role_params = {}
|
||||
if default_vars is None:
|
||||
default_vars = {}
|
||||
if sudo_vars is None:
|
||||
sudo_vars = {}
|
||||
if become_vars is None:
|
||||
become_vars = {}
|
||||
|
||||
old_conditions = list(additional_conditions)
|
||||
|
||||
|
|
@ -560,14 +574,37 @@ class Play(object):
|
|||
if not isinstance(x, dict):
|
||||
raise errors.AnsibleError("expecting dict; got: %s, error in %s" % (x, original_file))
|
||||
|
||||
# evaluate sudo vars for current and child tasks
|
||||
included_sudo_vars = {}
|
||||
for k in ["sudo", "sudo_user"]:
|
||||
# evaluate privilege escalation vars for current and child tasks
|
||||
included_become_vars = {}
|
||||
for k in ["become", "become_user", "become_method", "become_exe"]:
|
||||
if k in x:
|
||||
included_sudo_vars[k] = x[k]
|
||||
elif k in sudo_vars:
|
||||
included_sudo_vars[k] = sudo_vars[k]
|
||||
x[k] = sudo_vars[k]
|
||||
included_become_vars[k] = x[k]
|
||||
elif k in become_vars:
|
||||
included_become_vars[k] = become_vars[k]
|
||||
x[k] = become_vars[k]
|
||||
|
||||
## backwards compat with old sudo/su directives
|
||||
if 'sudo' in x or 'sudo_user' in x:
|
||||
included_become_vars['become'] = x['sudo']
|
||||
x['become'] = x['sudo']
|
||||
x['become_method'] = 'sudo'
|
||||
del x['sudo']
|
||||
|
||||
if x.get('sudo_user', False):
|
||||
included_become_vars['become_user'] = x['sudo_user']
|
||||
x['become_user'] = x['sudo_user']
|
||||
del x['sudo_user']
|
||||
|
||||
elif 'su' in x or 'su_user' in x:
|
||||
included_become_vars['become'] = x['su']
|
||||
x['become'] = x['su']
|
||||
x['become_method'] = 'su'
|
||||
del x['su']
|
||||
|
||||
if x.get('su_user', False):
|
||||
included_become_vars['become_user'] = x['su_user']
|
||||
x['become_user'] = x['su_user']
|
||||
del x['su_user']
|
||||
|
||||
if 'meta' in x:
|
||||
if x['meta'] == 'flush_handlers':
|
||||
|
|
@ -596,7 +633,7 @@ class Play(object):
|
|||
included_additional_conditions.append(x[k])
|
||||
elif type(x[k]) is list:
|
||||
included_additional_conditions.extend(x[k])
|
||||
elif k in ("include", "vars", "role_params", "default_vars", "sudo", "sudo_user", "role_name", "no_log"):
|
||||
elif k in ("include", "vars", "role_params", "default_vars", "sudo", "sudo_user", "role_name", "no_log", "become", "become_user", "su", "su_user"):
|
||||
continue
|
||||
else:
|
||||
include_vars[k] = x[k]
|
||||
|
|
@ -643,7 +680,7 @@ class Play(object):
|
|||
for y in data:
|
||||
if isinstance(y, dict) and 'include' in y:
|
||||
y['role_name'] = new_role
|
||||
loaded = self._load_tasks(data, mv, role_params, default_vars, included_sudo_vars, list(included_additional_conditions), original_file=include_filename, role_name=new_role)
|
||||
loaded = self._load_tasks(data, mv, role_params, default_vars, included_become_vars, list(included_additional_conditions), original_file=include_filename, role_name=new_role)
|
||||
results += loaded
|
||||
elif type(x) == dict:
|
||||
task = Task(
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue