mirror of
https://github.com/ansible-collections/community.general.git
synced 2026-03-22 05:09:12 +00:00
7eaf551b24
The pfexec become plugin has had incorrect defaults since it was migrated from Ansible core, making it unusable on illumos without manual workarounds: 1. become_flags defaulted to '-H -S -n' which are sudo flags. pfexec does not accept any of these options, causing: 'exec: illegal option -- H' 2. wrap_exe defaulted to false. Unlike sudo, pfexec does not interpret shell constructs internally. Since Ansible generates compound commands (echo BECOME-SUCCESS-xxx ; python3), these must be wrapped in /bin/sh -c for pfexec to execute them. These issues were originally reported in 2016 (ansible/ansible#15642), migrated to community.general as #3671, and partially fixed by PR #3889 in 2022 (which corrected quoting but not the defaults). Users have had to work around this with explicit inventory settings ever since. Changes: - become_flags default: '-H -S -n' -> '' (empty) - wrap_exe default: false -> true - build_become_command: handle empty flags cleanly - Updated tests to match corrected defaults - Added test for custom flags - Improved wrap_exe description to explain why it should be enabled
106 lines
3.3 KiB
Python
106 lines
3.3 KiB
Python
# Copyright (c) 2012-2014, Michael DeHaan <michael.dehaan@gmail.com>
|
|
# Copyright (c) 2020 Ansible Project
|
|
#
|
|
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
# Make coding more python3-ish
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
|
|
from ansible import context
|
|
|
|
from .helper import call_become_plugin
|
|
|
|
|
|
def test_pfexec_basic(mocker, parser, reset_cli_args):
|
|
"""Test pfexec with default settings (no flags, wrap_exe enabled)."""
|
|
options = parser.parse_args([])
|
|
context._init_global_context(options)
|
|
|
|
default_cmd = "/bin/foo"
|
|
default_exe = "/bin/bash"
|
|
pfexec_exe = "pfexec"
|
|
|
|
success = "BECOME-SUCCESS-.+?"
|
|
|
|
task = {
|
|
"become_method": "community.general.pfexec",
|
|
}
|
|
var_options = {}
|
|
cmd = call_become_plugin(task, var_options, cmd=default_cmd, executable=default_exe)
|
|
print(cmd)
|
|
# With wrap_exe=true (default), command is wrapped in shell -c
|
|
assert re.match(f"""{pfexec_exe} {default_exe} -c 'echo {success}; {default_cmd}'""", cmd) is not None
|
|
|
|
|
|
def test_pfexec_no_wrap(mocker, parser, reset_cli_args):
|
|
"""Test pfexec with wrap_exe disabled (legacy behaviour)."""
|
|
options = parser.parse_args([])
|
|
context._init_global_context(options)
|
|
|
|
default_cmd = "/bin/foo"
|
|
default_exe = "/bin/bash"
|
|
pfexec_exe = "pfexec"
|
|
|
|
success = "BECOME-SUCCESS-.+?"
|
|
|
|
task = {
|
|
"become_method": "community.general.pfexec",
|
|
"become_flags": "",
|
|
}
|
|
var_options = {
|
|
"ansible_pfexec_wrap_execution": "false",
|
|
}
|
|
cmd = call_become_plugin(task, var_options, cmd=default_cmd, executable=default_exe)
|
|
print(cmd)
|
|
assert re.match(f"""{pfexec_exe} 'echo {success}; {default_cmd}'""", cmd) is not None
|
|
|
|
|
|
def test_pfexec_custom_flags(mocker, parser, reset_cli_args):
|
|
"""Test pfexec with custom flags."""
|
|
options = parser.parse_args([])
|
|
context._init_global_context(options)
|
|
|
|
default_cmd = "/bin/foo"
|
|
default_exe = "/bin/bash"
|
|
pfexec_exe = "pfexec"
|
|
pfexec_flags = "-P basic"
|
|
|
|
success = "BECOME-SUCCESS-.+?"
|
|
|
|
task = {
|
|
"become_method": "community.general.pfexec",
|
|
"become_flags": pfexec_flags,
|
|
}
|
|
var_options = {}
|
|
cmd = call_become_plugin(task, var_options, cmd=default_cmd, executable=default_exe)
|
|
print(cmd)
|
|
assert re.match(f"""{pfexec_exe} {pfexec_flags} {default_exe} -c 'echo {success}; {default_cmd}'""", cmd) is not None
|
|
|
|
|
|
def test_pfexec_varoptions(mocker, parser, reset_cli_args):
|
|
"""Test that var_options override task options."""
|
|
options = parser.parse_args([])
|
|
context._init_global_context(options)
|
|
|
|
default_cmd = "/bin/foo"
|
|
default_exe = "/bin/bash"
|
|
pfexec_exe = "pfexec"
|
|
|
|
success = "BECOME-SUCCESS-.+?"
|
|
|
|
task = {
|
|
"become_user": "foo",
|
|
"become_method": "community.general.pfexec",
|
|
"become_flags": "xxx",
|
|
}
|
|
var_options = {
|
|
"ansible_become_user": "bar",
|
|
"ansible_become_flags": "",
|
|
}
|
|
cmd = call_become_plugin(task, var_options, cmd=default_cmd, executable=default_exe)
|
|
print(cmd)
|
|
# var_options override task flags, so flags should be empty
|
|
assert re.match(f"""{pfexec_exe} {default_exe} -c 'echo {success}; {default_cmd}'""", cmd) is not None
|