diff options
| author | Sam Yaple <sam@yaple.net> | 2015-07-05 07:20:16 +0000 |
|---|---|---|
| committer | Sam Yaple <sam@yaple.net> | 2015-07-14 02:51:54 +0000 |
| commit | 37ca7222bb83ff0de15c0502551b7e9e0960983a (patch) | |
| tree | 0d9c37c1d23990ea6d25f49b6adb77e69d96c21f | |
| parent | bdfcd74cf297ae448a63f434282b56fdf4d20d7a (diff) | |
| download | kolla-37ca7222bb83ff0de15c0502551b7e9e0960983a.tar.gz kolla-37ca7222bb83ff0de15c0502551b7e9e0960983a.zip | |
fix possible symlink attack with ansible
The commands used to create a temporary file on the localhost were
vulnerable to a symlink attack. Removing the shell module and ensuring
the ansible copy and file module is used will verify this file exists as a
file with the correct permissions and ownership
Change-Id: I829483edf1435e41726ebfe1bc826e0c2e5265e3
Closes-Bug: 1471376
| -rw-r--r-- | ansible/roles/database/tasks/bootstrap.yml | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/ansible/roles/database/tasks/bootstrap.yml b/ansible/roles/database/tasks/bootstrap.yml index 6653ebbd7..82b23bfa7 100644 --- a/ansible/roles/database/tasks/bootstrap.yml +++ b/ansible/roles/database/tasks/bootstrap.yml @@ -1,9 +1,13 @@ --- +- name: Cleaning up temp file on localhost + local_action: file path=/tmp/kolla_mariadb_cluster state=absent + changed_when: False + always_run: True + run_once: True + - name: Creating temp file on localhost - local_action: shell echo 'None' > /tmp/kolla_mariadb_cluster - register: status + local_action: copy content=None dest=/tmp/kolla_mariadb_cluster owner=root group=root mode=0600 changed_when: False - failed_when: status.rc != 0 always_run: True run_once: True @@ -17,10 +21,8 @@ run_once: True - name: Writing hostname of host with existing cluster files to temp file - local_action: shell echo "{{ ansible_hostname }}" > /tmp/kolla_mariadb_cluster - register: status + local_action: copy content={{ ansible_hostname }} dest=/tmp/kolla_mariadb_cluster owner=root group=root mode=0600 changed_when: False - failed_when: status.rc != 0 always_run: True when: exists.rc == 0 @@ -29,10 +31,8 @@ delegate_host: "{{ lookup('file', '/tmp/kolla_mariadb_cluster') }}" - name: Cleaning up temp file on localhost - local_action: shell rm /tmp/kolla_mariadb_cluster - register: status + local_action: file path=/tmp/kolla_mariadb_cluster state=absent changed_when: False - failed_when: status.rc != 0 always_run: True run_once: True |