Initial support for sudoable commands over fireball2

Caveats:
* requiretty must be disabled in the sudoers config
* asking for a password doesn't work yet, so any sudoers users must
  be configured with NOPASSWD
* if not starting the daemon as root, the user running the daemon
  must have sudoers entries to allow them to run the command as the
  target sudo_user
This commit is contained in:
James Cammarata 2013-08-27 13:12:35 -05:00
parent 4b552457e7
commit b45342923c
2 changed files with 83 additions and 30 deletions

View file

@ -61,15 +61,25 @@ class Connection(object):
def connect(self, allow_ssh=True):
''' activates the connection object '''
if self.is_connected:
return self
try:
self.conn = socket.socket()
self.conn.connect((self.host,self.fbport))
if not self.is_connected:
# TODO: make the timeout and retries configurable?
tries = 10
self.conn = socket.socket()
self.conn.settimeout(30.0)
while tries > 0:
try:
self.conn.connect((self.host,self.fbport))
break
except:
time.sleep(0.1)
tries -= 1
if tries == 0:
vvv("Could not connect via the fireball2 connection, exceeded # of tries")
raise errors.AnsibleError("Failed to connect")
except:
if allow_ssh:
print "Falling back to ssh to startup accelerated mode"
vvv("Falling back to ssh to startup accelerated mode")
res = self._execute_fb_module()
return self.connect(allow_ssh=False)
else:
@ -84,23 +94,29 @@ class Connection(object):
def recv_data(self):
header_len = 8 # size of a packed unsigned long long
data = b""
while len(data) < header_len:
d = self.conn.recv(1024)
if not d:
return None
data += d
data_len = struct.unpack('Q',data[:header_len])[0]
data = data[header_len:]
while len(data) < data_len:
d = self.conn.recv(1024)
if not d:
return None
data += d
return data
try:
while len(data) < header_len:
d = self.conn.recv(1024)
if not d:
return None
data += d
data_len = struct.unpack('Q',data[:header_len])[0]
data = data[header_len:]
while len(data) < data_len:
d = self.conn.recv(1024)
if not d:
return None
data += d
return data
except socket.timeout:
raise errors.AnsibleError("timed out while waiting to receive data")
def exec_command(self, cmd, tmp_path, sudo_user, sudoable=False, executable='/bin/sh'):
''' run a command on the remote host '''
if self.runner.sudo or sudoable and sudo_user:
cmd, prompt = utils.make_sudo_cmd(sudo_user, executable, cmd)
vvv("EXEC COMMAND %s" % cmd)
data = dict(
@ -112,12 +128,15 @@ class Connection(object):
data = utils.jsonify(data)
data = utils.encrypt(self.key, data)
if self.send_data(data):
raise errors.AnisbleError("Failed to send command to %s:%s" % (self.host,self.port))
raise errors.AnisbleError("Failed to send command to %s" % self.host)
response = self.recv_data()
if not response:
raise errors.AnsibleError("Failed to get a response from %s" % self.host)
response = utils.decrypt(self.key, response)
response = utils.parse_json(response)
vvv("COMMAND DONE: rc=%s" % str(response.get('rc',"<unknown>")))
return (response.get('rc',None), '', response.get('stdout',''), response.get('stderr',''))
def put_file(self, in_path, out_path):
@ -132,17 +151,23 @@ class Connection(object):
data = base64.b64encode(data)
data = dict(mode='put', data=data, out_path=out_path)
if self.runner.sudo:
data['user'] = self.runner.sudo_user
# TODO: support chunked file transfer
data = utils.jsonify(data)
data = utils.encrypt(self.key, data)
if self.send_data(data):
raise errors.AnsibleError("failed to send the file to %s:%s" % (self.host,self.port))
raise errors.AnsibleError("failed to send the file to %s" % self.host)
response = self.recv_data()
response = utils.decrypt(self.key, data)
if not response:
raise errors.AnsibleError("Failed to get a response from %s" % self.host)
response = utils.decrypt(self.key, response)
response = utils.parse_json(response)
# no meaningful response needed for this
if response.get('failed',False):
raise errors.AnsibleError("failed to put the file in the requested location")
def fetch_file(self, in_path, out_path):
''' save a remote file to the specified path '''
@ -152,10 +177,12 @@ class Connection(object):
data = utils.jsonify(data)
data = utils.encrypt(self.key, data)
if self.send_data(data):
raise errors.AnsibleError("failed to initiate the file fetch with %s:%s" % (self.host,self.port))
raise errors.AnsibleError("failed to initiate the file fetch with %s" % self.host)
response = self.recv_data()
response = utils.decrypt(self.key, data)
if not response:
raise errors.AnsibleError("Failed to get a response from %s" % self.host)
response = utils.decrypt(self.key, response)
response = utils.parse_json(response)
response = response['data']
response = base64.b64decode(response)