diff --git a/changelogs/fragments/more-world-readable-warning-skips.yaml b/changelogs/fragments/more-world-readable-warning-skips.yaml new file mode 100644 index 00000000000..1987db5d908 --- /dev/null +++ b/changelogs/fragments/more-world-readable-warning-skips.yaml @@ -0,0 +1,7 @@ +--- +bugfixes: +- The fix for `CVE-2018-10875 `_ + prints out a warning message about skipping a config file from a world + writable current working directory. However, if the user is in a world + writable current working directory which does not contain a config file, it + should not print a warning message. This release fixes that extaneous warning. diff --git a/lib/ansible/config/manager.py b/lib/ansible/config/manager.py index 7d020535552..ab0db12926a 100644 --- a/lib/ansible/config/manager.py +++ b/lib/ansible/config/manager.py @@ -176,10 +176,14 @@ def find_ini_config_file(warnings=None): try: cwd = os.getcwd() perms = os.stat(cwd) + cwd_cfg = os.path.join(cwd, "ansible.cfg") if perms.st_mode & stat.S_IWOTH: - warn_cmd_public = True + # Working directory is world writable so we'll skip it. + # Still have to look for a file here, though, so that we know if we have to warn + if os.path.exists(cwd_cfg): + warn_cmd_public = True else: - potential_paths.append(os.path.join(cwd, "ansible.cfg")) + potential_paths.append(cwd_cfg) except OSError: # If we can't access cwd, we'll simply skip it as a possible config source pass diff --git a/test/units/config/manager/test_find_ini_config_file.py b/test/units/config/manager/test_find_ini_config_file.py index f8f3d72c239..262adcfc321 100644 --- a/test/units/config/manager/test_find_ini_config_file.py +++ b/test/units/config/manager/test_find_ini_config_file.py @@ -144,6 +144,31 @@ class TestFindIniFile: assert find_ini_config_file(warnings) is None assert warnings == set() + # ANSIBLE_CONFIG not specified + @pytest.mark.parametrize('setup_env', [[None]], indirect=['setup_env']) + # All config files are present except in cwd + @pytest.mark.parametrize('setup_existing_files', + [[('/etc/ansible/ansible.cfg', cfg_in_homedir, cfg_file, alt_cfg_file)]], + indirect=['setup_existing_files']) + def test_no_cwd_cfg_no_warning_on_writable(self, setup_env, setup_existing_files, monkeypatch): + """If the cwd is writable but there is no config file there, move on with no warning""" + real_stat = os.stat + + def _os_stat(path): + if path == working_dir: + from posix import stat_result + stat_info = list(real_stat(path)) + stat_info[stat.ST_MODE] |= stat.S_IWOTH + return stat_result(stat_info) + else: + return real_stat(path) + + monkeypatch.setattr('os.stat', _os_stat) + + warnings = set() + assert find_ini_config_file(warnings) == cfg_in_homedir + assert len(warnings) == 0 + # ANSIBLE_CONFIG not specified @pytest.mark.parametrize('setup_env', [[None]], indirect=['setup_env']) # All config files are present