You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Sam Doran 0199b1cf05 [stable-2.9] Change default file permissions so they are not world readable (#70221) (#70825) ... * [stable-2.9] Change default file permissions so they are not world readable (#70221) * Change default file permissions so they are not world readable CVE-2020-1736 Set the default permissions for files we create with atomic_move() to 0o0660. Track which files we create that did not exist and warn if the module supports 'mode' and it was not specified and the module did not call set_mode_if_different(). This allows the user to take action and specify a mode rather than using the defaults. A code audit is needed to find all instances of modules that call atomic_move() but do not call set_mode_if_different(). The findings need to be documented in a changelog since we are not warning. Warning in those instances would be frustrating to the user since they have no way to change the module code. - use a set for storing list of created files - just check the argument spac and params rather than using another property - improve the warning message to include the default permissions. (cherry picked from commit 5260527c4a) Co-authored-by: Sam Doran <sdoran@redhat.com> * Fix jboss test * Fix lamdba_policy test * Fix aws_lamdba test * Fix warning for new default permissions when mode is not specified (#70976) Follow up to #70221 Related to #67794 CVE-2020-1736 When set_mode_if_different() is called with mode of 'None', ensure we issue a warning about the change in default permissions. Add integration tests to ensure the warning works properly. * Fix tests - actually use custom module 🤦‍♂️ - verify file permission on created files - use remote_tmp_dir so we're ready for split controller - improve test module so we can skip the call to set_fs_attributes_if_different() - fix tests for CentOS 6 (cherry-picked from commit dc79528cc6) * Use new category in changelog fragments		5 years ago
..
__init__.py	…
test__log_invocation.py	Porting tests to pytest (#33387)	8 years ago
test__symbolic_mode_to_octal.py	Split basic units (#33510)	8 years ago
test_argument_spec.py	[2.9] api: time.clock compatible code (#70678)	5 years ago
test_atomic_move.py	[stable-2.9] Change default file permissions so they are not world readable (#70221) (#70825)	5 years ago
test_deprecate_warn.py	[2.9] Prevent Ansible 2.9 to choke on collections using deprecation by date or collection_name for deprecation calls (#69935)	6 years ago
test_dict_converters.py	Split basic units (#33510)	8 years ago
test_exit_json.py	Split basic units (#33510)	8 years ago
test_filesystem.py	Move unit test compat code out of `lib/ansible/`. (#46996)	7 years ago
test_get_file_attributes.py	AnsibleModule.get_file_attributes: add unit test	8 years ago
test_get_module_path.py	Move unit test compat code out of `lib/ansible/`. (#46996)	7 years ago
test_heuristic_log_sanitize.py	Move unit test compat code out of `lib/ansible/`. (#46996)	7 years ago
test_imports.py	unit tests: remove unused imports (#59636)	7 years ago
test_log.py	Fix unit test parametrize order on Python 3.5.	7 years ago
test_no_log.py	Move _handle_no_log_values() out of basic.py (#48628)	7 years ago
test_platform_distribution.py	unit tests: remove unused imports (#59636)	7 years ago
test_run_command.py	[stable-2.9] Fix filedescriptor out of range in select() when running commands (#65058) (#69517)	6 years ago
test_safe_eval.py	Porting tests to pytest (#33387)	8 years ago
test_sanitize_keys.py	Sanitize URI module keys with no_log values (#70762) (#70821)	5 years ago
test_selinux.py	Move unit test compat code out of `lib/ansible/`. (#46996)	7 years ago
test_set_mode_if_different.py	unit tests: remove unused imports (#60462)	6 years ago
test_tmpdir.py	Move unit test compat code out of `lib/ansible/`. (#46996)	7 years ago