Crash with ansible in become from root to user #734
Comments
|
Let me say that the file already exists so the shell command is not meant to run in this play. And the mitogen version is v0.2.9. |
|
Tested it with the current master but the same result. |
|
Can you try these tasks? I'm curious on where it's going to fail. Your error is during Mitogen's setup, where it tries to change into the |
|
As expected, the first su to the non-root user fail The directory /root/.ansible is mode 700. It was automatically created by ansible and this should not be a factor as the chdir should happen before the su happen. For security it makes sense to chdir to / before any rights (de)escalation. How does ansible itself solves that? |
|
You state Can you run the playbook I posted before without Mitogen? I would think it should still fail because of this block here: This block ^^^ is telling Ansible/Mitogen to run a task via |
|
Sure I can do it. But I don't expect something new. the playbook worked before I migrated to mitogen. Let me tell you, that I even added a When I use So, in between the playbook above run without problem commenting out mitogen from ansible.cfg. Your use case doesn't meet in that case. Remember, ansible-pull is run by root and does (in this case) a deescalation to a unprivileged user. Further more, I don't see why the check for existence should also be done after the su (even if it should be safe to do so to support the other way around, changing to root). About your chdir, I think, you miss something. There is no explicit chdir into the directory with no rights. And the gitolite_user has also full rights to gitolite_path. Remember, I speak about the chdir, done before executing (or checking) in the shell module. Eventually explicit given as described above but at least to Let me summary that:
Sorry that I cannot dive into the python code. My python knowledge is very limited. I came from the perl side. ;-) |
|
Thanks for this info! It's definitely a bug in Mitogen if it works in Ansible without Mitogen. I think there's enough info here to reproduce the problem on my end; I'll try to get to this issue in a week or two if it hasn't been picked up by someone else in that time (currently banging my head on trying to get #723 to work) |
|
@mowgli do you have a simple standalone playbook I could use to replicate the issue? I tried replicating the issue but I don't use Here's what I tried running inside a container: but it worked because the container doesn't have anything in the |
|
Hi Steven,
Am So den 16. Aug 2020 um 7:28 schrieb Steven Robertson:
@mowgli do you have a simple standalone playbook I could use to replicate the issue? I tried replicating the issue but I don't use `ansible-pull` so am not sure how you ran things.
Here's what I tried running inside a container:
Centos8 OS
Ansible 2.7.5
Python 2
```
- name: make dir owned by root
become: True
file:
path: /root/.ansible
state: directory
mode: '0600'
vars:
ansible_python_interpreter: "/usr/libexec/platform-python"
- name: create new test user in container
become: True
user:
name: dummy
shell: /bin/bash
vars:
ansible_python_interpreter: "/usr/libexec/platform-python"
- name: run something as a different user
shell: echo "foo"
become: True
become_method: su
become_user: dummy
vars:
ansible_python_interpreter: "/usr/libexec/platform-python"
```
but it worked because the container doesn't have anything in the `/root/.ansible` dir.
--
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub:
#734 (comment)
I suggest the following script as root:
```bash
#! /bin/sh
if [ $LOGNAME != "root" ]
then
echo "The script has to run as root"
exit 1
fi
mkdir -p /root/.ansible/tmp /root/.ansible/pull
chmod 700 /root/.ansible /root/.ansible/tmp
cd /root/.ansible/pull
[ -e test ] && rm -fr test
git clone /tmp/testansible.bundle test
cd test
ansible-playbook -i hosts test.yaml
```
Where you put a bundle /tmp/testansible.bundle of your test playbook to.
Alternativelly replace the git clone with a tar or something that
creates the test directory with the playbook.
This should replicate the behaviour of ansible-pull.
Your playbook about is run from a different user than root. So it will
never use the /root/.ansible directory. But this is the key point. The
playbook is run as root and `/root/.ansible/pull/<hostname>` holds the
git clone of your playbook.
Ah yes, I looked into the ansible-pull script where you see the
following:
```python
b_ansible_dir = os.path.expanduser(os.path.expandvars(b"~/.ansible"))
try:
os.mkdir(b_ansible_dir, 0o700)
except OSError as exc:
if exc.errno != errno.EEXIST:
display.warning("Failed to create the directory '%s': %s"
% (to_text(b_ansible_dir, errors='surrogate_or_replace'),
to_text(exc, errors='surrogate_or_replace')))
else:
display.debug("Created the '%s' directory" % to_text(b_ansible_dir, errors='surrogate_or_replace'))
```
Regards
Klaus
--
Klaus Ethgen http://www.ethgen.ch/
pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen <[email protected]>
Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C
|
|
@mowgli thanks so much for the repro steps! :D If you'd like to take a look in the meantime, you could play around with where the error happens: https://github.com/dw/mitogen/blob/master/ansible_mitogen/runner.py#L384 Here's how I test Mitogen patches: https://github.com/s1113950/mitogen-test and what I was doing to try and get your issue to work: and then for debugging, I like the |
|
Also sorry for closing, was a misclick when I meant to hit |
When I run the following task, ansible in pull mode fails badly with the following stackdump when using mitogen.
The text was updated successfully, but these errors were encountered: