mirror of https://github.com/ansible/ansible.git
fix vault temp file handling (#68433)
* fix vault tmpe file handling * use local temp dir instead of system temp * ensure each worker clears dataloader temp files * added test for dangling temp files * added notes to data loader CVE-2020-10685pull/68472/head
parent
f633772942
commit
6452a82452
@ -0,0 +1,2 @@
|
||||
bugfixes:
|
||||
- Ensure DataLoader temp files are removed at appropriate times and that we observe the LOCAL_TMP setting.
|
@ -0,0 +1 @@
|
||||
THIS IS OK
|
@ -0,0 +1,7 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
37626439373465656332623633333336353334326531333666363766303339336134313136616165
|
||||
6561333963343739386334653636393363396366396338660a663537666561643862343233393265
|
||||
33336436633864323935356337623861663631316530336532633932623635346364363338363437
|
||||
3365313831366365350a613934313862313538626130653539303834656634353132343065633162
|
||||
34316135313837623735653932663139353164643834303534346238386435373832366564646236
|
||||
3461333465343434666639373432366139363566303564643066
|
@ -0,0 +1,34 @@
|
||||
- hosts: localhost
|
||||
gather_facts: False
|
||||
vars:
|
||||
od: "{{output_dir|default('/tmp')}}/test_vault_assemble"
|
||||
tasks:
|
||||
- name: create target directory
|
||||
file:
|
||||
path: "{{od}}"
|
||||
state: directory
|
||||
|
||||
- name: assemble_file file with secret
|
||||
assemble:
|
||||
src: files/test_assemble
|
||||
dest: "{{od}}/dest_file"
|
||||
remote_src: no
|
||||
mode: 0600
|
||||
|
||||
- name: remove assembled file with secret (so nothing should have unencrypted secret)
|
||||
file: path="{{od}}/dest_file" state=absent
|
||||
|
||||
- name: find temp files with secrets
|
||||
find:
|
||||
paths: '{{temp_paths}}'
|
||||
contains: 'VAULT TEST IN WHICH BAD THING HAPPENED'
|
||||
recurse: yes
|
||||
register: badthings
|
||||
vars:
|
||||
temp_paths: "{{[lookup('env', 'TMP'), lookup('env', 'TEMP'), hardcoded]|flatten(1)|unique|list}}"
|
||||
hardcoded: ['/tmp', '/var/tmp']
|
||||
|
||||
- name: ensure we failed to find any
|
||||
assert:
|
||||
that:
|
||||
- badthings['matched'] == 0
|
Loading…
Reference in New Issue