Commit Graph

45 Commits (bce0f2152c9fd52f607ef75dac87bd8e94290db7)

Author SHA1 Message Date
Steve Boyd 9693a55286 (action/script) Fix windows absolute path detection when executing powershell script (#50365) 2019-01-07 06:44:54 +10:00
Matt Davis 8c1f701e6e
split PS wrapper and payload (CVE-2018-16859) (#49142)
* prevent scriptblock logging from logging payload contents
* added tests to verify no payload contents in PS Operational event log
* fix script action to send split-aware wrapper
* fix CLIXML error parser (return to -EncodedCommand exposed problems with it)
2018-11-26 15:28:21 -08:00
Jordan Borean e972287c35 win_exec: refactor PS exec runner (#45334)
* win_exec: refactor PS exec runner

* more changes for PSCore compatibility

* made some changes based on the recent review

* split up module exec scripts for smaller payload

* removed C# module support to focus on just error msg improvement

* cleaned up c# test classifier code
2018-10-02 15:55:53 -07:00
Jordan Borean d81249994e
win_script: add support for become and centralise exec wrapper builder (#45582)
* win_script: add support for become and centralise exec wrapper builder

* satisfying the pep8 gods

* do not scan for module dependencies when running as a script
2018-09-13 08:50:13 +10:00
tranceitionalMynd 04e3c964fb Added executable parameter to the script module (#36969)
* Added interpreter parameter to the script module

* Let required and default parameters get documented implicitly for binary parameter

* Renamed interpreter parameter to executable
2018-05-25 14:40:48 -05:00
Toshio Kuratomi edaeb69a35 Fix the script and patch plugins tempfile ownership
Unified tmp accidentally removed the containing tmpdir from the list of
files to fix the permissions on when we're becoming a different
unprivileged user.  This resulted in a visible bug for script but not
for patch.  This is because patch also uploads the module to the same
temporary directory and the uploaded module also ends up calling
fixup_perms2() which includes the temporary directory.  So by the time
patch needs to access the temporary patch file, the directory is
appropriately set.

script's breakage was visible because script does not upload a module
(it's akin to raw in this way).  Therefore, we only call fixup_perms2()
once in script and so leaving out the tmpdir in script means that the
containing directory never has its permissions set appropriately.

Fixing both because it does not cause an extra round trip for patch so
any speedup would be minimal and it's better to fix the perms as close
as possible to where we know we need it.  Otherwise, changes to
seemingly unrelated code later could end up breaking it.

Fixes #36398
2018-02-19 13:07:58 -08:00
Toshio Kuratomi 06f73ad578
Normalize usage of temp and tmp on tmp (#36221)
* Normalize usage of temp and tmp on tmp
* Rename system_tmps system_tmpdirs
* Add ANSIBLE_REMOTE_TMP spelling of environment variables
2018-02-15 09:01:02 -08:00
Toshio Kuratomi 71f46d69d6 First bit of fixing temporary to have one source of truth (#35747)
* First bit of fixing temporary to have one source of truth

* Fix pep8

* Remove explicit make_tmp_path() in copy

The copy action plugin sets TRANSFER_FILES=True so it does not need to
set the temporary directory explicitly; the base class's run() method
will do that for us.

* Fix for calling a module's run when a shell has already created a temp path.

* Remember to inform the rest of the world when tempdir is removed

* New strategy for how to warn on passing tmp

Now we just warn when calling the parent class run() early.  If the
module does a late call to the parent run() and doesn't make use of the
temporary directory, then we don't check for the possibility that the
user mistakenly is sending tmp in.  If we truly deprecate this (rather
than ignoring it forever) then we might want to switch back to checking
for someone passing a value in as tmp.

* Remove tmp parameter from _execute_module as well

* Port all action plugins to not send tmp explicitly

This is now handled inside of _execute_module via the
_connection._shell.tempdir attribute.

Also update warnings and docs to tell people to set the attribute
instead of using _execute_module's tmp parameter.

* Always set local tempdir variable
2018-02-07 15:11:36 -08:00
Toshio Kuratomi 32eef49062 Make AnsibleActionDone a private exception
We're going to remove this in the future so mark it private so people
are less likely to use it.
2018-01-22 23:36:34 -08:00
Jordan Borean 389f4ef1fb
template: change to pass along the correct template path (#35027)
* template: change to pass along the correct template path

* standardise tmp path behaviour

* removed if condition as it should not be needed
2018-01-19 09:51:42 +10:00
Jordan Borean f0134079e3
win_script: work when argument exceeds stdin buffer size (#33855)
* win_script: work when argument exceeds stdin buffer size

* Added test for large argument being passed
2018-01-18 11:28:33 +10:00
Brian Coca bbd6b8bb42 Temporary (#31677)
* allow shells to have per host options, remote_tmp

added language to shell
removed module lang setting from general as  plugins have it now
use get to avoid bad powershell plugin
more resilient tmp discovery, fall back to `pwd`
add shell to docs
fixed options for when frags are only options
added shell set ops in t_e and fixed option frags
normalize tmp dir usag4e

- pass tmpdir/tmp/temp options as env var to commands, making it default for tempfile
- adjusted ansiballz tmpdir
- default local tempfile usage to the configured local tmp
- set env temp in action

add options to powershell
shift temporary to internal envvar/params
ensure tempdir is set if we pass var
ensure basic and url use expected tempdir
ensure localhost uses local tmp
give /var/tmp priority, less perms issues
more consistent tempfile mgmt for ansiballz
made async_dir configurable
better action handling, allow for finally rm tmp
fixed tmp issue and no more tempdir in ballz
hostvarize world readable and admin users
always set shell tempdir
added comment to discourage use of exception/flow control

* Mostly revert expand_user as it's not quite working.

This was an additional feature anyhow.

Kept the use of pwd as a fallback but moved it to a second ssh
connection.  This is not optimal but getting that to work in a single
ssh connection was part of the problem holding this up.

(cherry picked from commit 395b714120522f15e4c90a346f5e8e8d79213aca)

* fixed script and other action plugins

ensure tmpdir deletion
allow for connections that don't support new options (legacy, 3rd party)
fixed tests
2018-01-15 21:15:04 -08:00
Sam Doran ea3638b580 Add proper check mode support to the script module (#31852)
* Do not run script in check mode

Fixes #30676

* Reformat script integration test

* Add integration tests for check mode of script module

* Fix name on test

* Cleanup temp file

* win_script integration test syntaxt changes

* Add check mode tests for win_script

* Use proper variable in test

* Fail if source file does not exist

* Verify script is accessible and don't copy in check mode

Use shlex to properly split shell arguments, though a path with spaces in it still needs to be quoted in the playbook.
Add note to docs describing such.
Improve error message if file is not found indicating there may be a space in the path.

* Properly encode path now that path is split using shlex

* Allow for spaces in both path and script name

* Add unicode character test to Linux script tests

* Add Linux test for space in path to script
2017-11-13 15:33:44 -08:00
Karim BEN YOUSSEF 804f40f7a5 script: Add support for chdir argument 2017-07-07 09:40:02 -07:00
Dag Wieers 5553b20828 Collated PEP8 fixes (#25293)
- Make PEP8 compliant
2017-06-02 12:14:11 +01:00
Dag Wieers 0e160d5c7e Ensure exit_json returns failed = False
This is required for modules that may return a non-zero `rc` value for a
successful run, similar to #24865 for Windows fixing **win_chocolatey**.

We also disable the dependency on `rc` value only, even if `failed` was
set.

Adapted unit and integration tests to the new scheme.
Updated raw, shell, script, expect to take `rc` into account.
2017-05-30 14:56:31 -07:00
Brian Coca e29dc49a49 moved to exceptions for basic skip/fails
better handling of checkmode and async
fix test to follow new flow control
2017-04-25 14:48:56 -04:00
Brian Coca fe9af903f3 script fails on async 2017-04-20 11:49:10 -04:00
Brian Coca 7b197d823e let user control "auto-de-vault" (#22739)
* added option to toggle off autodevaulting

* fixes per feedbazck
2017-03-24 15:39:25 -04:00
Matt Davis 73f50b4f9f fix Windows env handling (#22927)
* fixes #22441
* fixes #22655
* moves all env handling into the exec wrapper; this should work for everything but raw, which is consistent with non-Windows.
2017-03-23 17:48:15 -07:00
Matt Davis 8527013fbe Complete rewrite of Windows exec wrapper (#21510)
* supports pipelining for faster execution
* supports become (runas), creates interactive subsession under WinRM batch logon
* supports usage of arbitrary module_utils files
* modular exec wrapper payload supports easier extension
* integrates async wrapper behavior for pipelined/become'd async
* module_utils are loaded as true Powershell modules, no more runtime modifications to module code
2017-02-17 00:09:56 -08:00
Brian Coca c86a17b7a0 refactoring async
- centralized skipping
- also fixed module name broken by previous refactor
- let action modules handle async processing
- moved async into base action class's module exec
- action plugins can now run final action as async
- actually skip copy if base skips
- fixed normal for new paths
- ensure internal stat is never async
- default poll to 10 as per docs
- added hint for callback fix on poll
- restructured late tmp, now a pipeline query
- moving action handler to connection as networking does
- fixed network assumption invocation is always passed
- centralized key cleanup, normalized internal var
- _supress_tmpdir_delete now in _ansible_xxx and gets removed from results
- delay internal key removal till after we use em
- nicer tmp removing, using existing methods
- moved cleanup tmp flag to mking tmp func
2017-02-06 19:32:00 -05:00
Brian Coca 58b6027a75 remote user should rely on context, not direct var
this can cause issues with non-ssh connections and/or ansible_user
2017-01-19 12:15:45 -05:00
Toshio Kuratomi 4ed88512e4 Move uses of to_bytes, to_text, to_native to use the module_utils version (#17423)
We couldn't copy to_unicode, to_bytes, to_str into module_utils because
of licensing.  So once created it we had two sets of functions that did
the same things but had different implementations.  To remedy that, this
change removes the ansible.utils.unicode versions of those functions.
2016-09-06 22:54:17 -07:00
Matt Clay 94a0d2afb4 Add partially backwards compatible version of _fixup_perms. (#17427)
Also added a deprecation notice for _fixup_perms.

Resolves issue #17352 (assumes custom actions use recursive=False).
2016-09-06 16:49:59 -07:00
Matt Clay 72cca01cd4 Use file list, not recursion, in _fixup_perms. (#16924)
Run setfacl/chown/chmod on each temp dir and file.

This fixes temp file permissions handling on platforms such as FreeBSD
which always return success when using find -exec. This is done by
eliminating the use of find when setting up temp files and directories.

Additionally, tests that now pass on FreeBSD have been enabled for CI.
2016-08-05 18:40:28 -07:00
Brian Coca bced8715cd add transparent vault use to other plugins (#16957)
assemble, script and unarchive (copy already had it).
2016-08-04 18:35:30 -04:00
Brian Coca 2bb7feec6d Search path (#16387)
* smarter function to figure out relative paths

takes list of paths in order of relevance to current task
and does the dwim magic on them

* shared function for action plugins using new dwim

unify path construction and error info/messaging
made include and role non exclusive
corrected order and now smarter about tasks
includes inside roles are currently broken as they don't provide the correct role data
make dirname full match to avoid corner cases

* migrated action plugins to new dwim function

reported plugins to use exceptions instead of info

* clarified needle
2016-06-28 17:23:30 -04:00
Brian Coca a529a60478 raw should not use default executable (#16085)
also removed unused cruft in script
2016-06-10 11:37:58 -04:00
Brian Coca a5d79a39d5 Ensure action plugins remove tmp dirs created (#15501)
fixes #14917
2016-04-20 13:39:12 -04:00
James Cammarata 26a4761d0f Fix logic error in script action plug related to use of shell.exists 2016-03-31 15:21:45 -04:00
Brian Coca 28d20dbe53 moved 'path exists' function to shell
now it will work with powershell/winrm
2016-03-25 12:56:48 -07:00
Brian Coca 1ebc2fda71 removes python requirement to script
mistakenly added when checksum was made to use stat module
fixed assertion in test
2016-03-24 16:17:58 -07:00
Toshio Kuratomi 52e9209491 Don't create world-readable module and tempfiles without explicit user permission 2016-03-23 09:52:19 -07:00
Matthew Stoltenberg d36394d6a6 strip BECOME-SUCCESS at lower level
Fixes #14395
2016-02-09 13:03:18 -05:00
James Cammarata 162dd2594f Filter become success string from the stdout of script results
Fixes #14390
2016-02-09 12:34:15 -05:00
Toshio Kuratomi 2e87c1f74e Two fixes to action plugins
* Fix the task_vars parameter to not default to a mutable type (dict)
* Implement invocation in the base class's run() method have each action
  module call the run() method's implemention in the base class.
* Return values from the action plugins' run() method takes the return
  value from the base class run() method into account so that invocation
  makes its way to the output.

Fixes #12869
2015-10-22 16:07:26 -07:00
Toshio Kuratomi a1428d6bed Remove tmp as a parameter to the connection plugins
There doesn't appear to be anything that actually uses tmp_path in the
connection plugins so we don't need to pass that in to exec_command.
That change also means that we don't need to pass tmp_path around in
many places in the action plugins any more.  there may be more cleanup
that can be done there as well (the action plugin's public run() method
takes tmp as a keyword arg but that may not be necessary).

As a sideeffect of this patch, some potential problems with chmod and
the patch, assemble, copy, and template modules has been fixed (those
modules called _remote_chmod() with the wrong order for their
parameters.  Removing the tmp parameter fixed them.)
2015-09-24 13:33:57 -07:00
Brian Coca 950622cebd made sure they all look in files/vars/template dirs also when executed in play and not only from task 2015-08-16 02:37:21 -04:00
Brian Coca c08305a31f set script command itself to be sudable and not use the chmod sudoable settings as it can
ignore sudo settings for script when become_user is not root
fixes #11902
2015-08-10 13:19:37 -04:00
James Cammarata e64989beb4 Moving ConnectionInformation -> PlayContext
Also making PlayContext a child class of the Playbook Base class,
which gives it access to all of the FieldAttribute code to ensure
field values are correctly typed after post_validation

Fixes #11381
2015-07-21 12:13:50 -04:00
James Cammarata cf51d0a790 Fixing up some check-mode stuff 2015-07-01 15:10:25 -04:00
Pierre-Louis Bonicoli 4d4512940d Fix "AttributeError: 'ActionModule' object has no attribute '_shell'"
'_shell' was removed with commit 2a5fbd8570
2015-07-01 17:22:09 +02:00
James Cammarata ee5e166563 Fixing ansible_*_interpreter use
Fixes ansible/ansible-modules-core#1459
2015-06-04 15:43:07 -04:00
James Cammarata ce3ef7f4c1 Making the switch to v2 2015-05-03 21:47:26 -05:00