* Change default file permissions so they are not world readable
CVE-2020-1736
Set the default permissions for files we create with atomic_move() to 0o0660. Track
which files we create that did not exist and warn if the module supports 'mode'
and it was not specified and the module did not call set_mode_if_different(). This allows the user to take action and specify a mode rather than using the defaults.
A code audit is needed to find all instances of modules that call atomic_move()
but do not call set_mode_if_different(). The findings need to be documented in
a changelog since we are not warning. Warning in those instances would be frustrating
to the user since they have no way to change the module code.
- use a set for storing list of created files
- just check the argument spac and params rather than using another property
- improve the warning message to include the default permissions.
(cherry picked from commit 5260527c4a)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* Remove community.crypto parts from porting guide.
* Remove community.general parts from porting guide.
* Removed 'modules removed' section, since this is better suited for a general entry on the collection split.
Change:
On OpenBSD when using pipelining, we do not set cwd which results in a
permissions fatal. Ensure that `''` - cwd - is not in `sys.path`.
Test Plan:
Tested against local OpenBSD VM
Tickets:
Fixes#69320
Signed-off-by: Rick Elrod <rick@elrod.me>
This fact reflects the number of usable vcpus (which might be different
from ansible_processor_vcpus, e.g., in containers with limits). See
also #51504.
* Add fixture data and update unit tests
Co-authored-by: Sam Doran <sdoran@redhat.com>
* ec2_tag - Deprecate the use of state=list
* Update lib/ansible/modules/cloud/amazon/ec2_tag.py
* Add changelog and porting_guide entries
Co-authored-by: flowerysong <junk+github@flowerysong.com>
* 'message' parameter is replaced by 'commit_message' in grafana_dashboard
* 'message' parameter is replaced by 'notification_message' in datadog_monitor
This change is required since 'message' as parameter name is used internally by
Ansible core engine.
Fixes: #39295#45362#47132#59617
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
* [aws_s3] fix deleting the current objects and the previous versions from a version-enabled bucket
* use existing paginated_list function to keep compatibility with the other places it is called
* changelog
* Add noteworthy change to the porting guide
* Reword that with acozine's suggestion
Co-authored-by: Alicia Cozine <879121+acozine@users.noreply.github.com>
* Clean up FILE_COMMON_ARGUMENTS.
* postgresql_pg_hba doesn't declare the backup option.
* uri doesn't declare the remote_src option.
* Add documentation.
* maven_artifact seems to use directory_mode, which it doesn't declare.
* Update changelogs/fragments/66389-file-common-arguments.yml
Update docs/docsite/rst/porting_guides/porting_guide_2.10.rst
ci_complete
Co-Authored-By: Jill R <4121322+jillr@users.noreply.github.com>
* aws_netapp_cvs_snapshots - minor required_if fixup (state must be set if state=present)
* ec2 - fix typo in mutually_exclusive definition
* rds_instance: fix typo in mutually_exclusive restore_to_time should be restore_time - currently throws a boto error
vmware_tag_info used to return dict of tag information which caused
data loss when there are multiple tags with same name and different category ids.
This fix will add additional fact "tag_info" which will deprecated existing fact
"tag_facts".
The "tag_info" is a list which handles multiple tags with same name.
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
* Deprecate Windows 2008, and 2008 R2
* Remove shippable nodes
* Update windows_faq.rst
Be less specific about 2008/R2 timeframes
* Update setup.ps1
tweak warning text
Co-authored-by: Matt Davis <nitzmahone@users.noreply.github.com>
* win_find - refactor to make more performance and use newer style
* win_find - refactor for performance improvements and alignment to find
* More path alignment to find
* Fix yamllint error
* iam_user: use AnsibleAWSModule.client to fetch connection rather than C&P code
* iam_role: Add deprecation warning so we can switch purge_polices default behaviour from true to false
* iam_user/role/group: Rename 'managed_policy' and 'purge_policy'
Rename from singluar to plural (we accept a *list* of policies), and add aliases for the old values.
* Cleanup documentation
* Changelog
* reworked iam_policy
* Deprecate policy_document option
* deprecate defaulting skip_duplicates to true
* No longer explicitly catch ParamValidationError.
ParamValidationErrror is already caught by ClientError
* Work with complex policy objects rather than json documents
comparisons can better cope with the special cases (eg True vs "True" )
* Enable check_mode tests and fix related 'changed' bug
* changelog
* doc cleanup based on review
* Add ldap_attrs module
* Fix codesyle error
* Apply deprecation rules
* Add support for X-ORDERED extension in ldap_attrs
The 'X-ORDERED' LDAP extension allows definition of ordered LDAP object
attributes. This extension is used in OpenLDAP "cn=config" database to
support ordered configuration options.
Specification: https://tools.ietf.org/html/draft-chu-ldap-xordered-00
* Update ldap_attr deprecation notice
* Documentation improvements based on suggestions
* Remove redundant dots from documentation
* Correct 'insertations' to 'insertions'
* Remove insecure 'params' option
* Fix sanity ignore errors
* Improve module documentation
* Change example value from string to list
* Fix support for "" values
* Restore module vmware_dns_config
* Remove domainname and change_hostname_to
* Changed version_added from 2.10 to '2.10'
* Add setup_attach_host: true to test case
* Add 'vcsim is not defined' block to integration tests
* Change 'result' to 'dns_config_result'
* Bugfix: Changing some static configurations while keeping others can crash the module
* Implement changing DNS config from DHCP to static on a cluster
* Update documentation for vmware_host_dns
* vmware_host_dns integration tests: Always revert to original DNS configuration, even if a test fails
* Deprecate vmware_dns_config
While deleting gitlab user, several parameters such as email, name,
password are not required. This fix removes this requirement from the
module.
Fixes: #61921
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
* ec2_ boilerplate
* Deprecate unused options.
* ec2_vol: Perform explicit type checking on volume_size and iops when parsing the args
Boto would through a type exception if the string couldn't be converted to an int.
* ec2_lc_find: remove duplicate definition of region
It's defined in ec2_argument_spec and ec2 doc fragment
* ec2_lc_info: Move responsibility for type checking/conversion of sort_start and sort_end into arg parser
* General sanity test related doc fixups
* Remove EC2 related sanity/ignore.txt entries
* Add changelog fragment
* Remove Sanity test ignore.txt entries
* Fixup boilerplate
* Remove use of blacklisted _ variable name
* cloudformation: Add an explicit removal version for template_format
This option's been ignored since ansible 2.3
* General docs cleanup to clear sanity errors
* elasticache_parameter_group: Add list of choices
- matches documented choices
- other values wouldn't have worked
* data_pipeline: Deprecate 'version' - always ignored
* Add deprecation documentation
Matt Davis