Skip to content

ansible: pin ANSIBLE_CONFIG to disable ambient config discovery #643

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sfc-gh-ikryvanos wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ansible: pin ANSIBLE_CONFIG to disable ambient config discovery #643

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion services/ansible/server/ansible.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,18 @@ var (
// AnsiblePlaybookBin is the location to the ansible binary. Binding this to a flag is often useful.
AnsiblePlaybookBin = "/usr/bin/ansible-playbook"

// AnsibleConfigFile pins the configuration file used by ansible-playbook via
// the ANSIBLE_CONFIG environment variable. Pinning it is important because
// ansible otherwise auto-discovers a config file from the process working
// directory (./ansible.cfg) or the home directory (~/.ansible.cfg). Since the
// server runs privileged and its working directory is not guaranteed to be
// trusted, a caller able to drop a file in those locations could supply a
// config that points plugin/library/roles paths at attacker-controlled code
// and gain execution on the next run. Defaulting to os.DevNull loads an empty
// config and disables that discovery; set it to a trusted path to supply a
// real configuration. Binding this to a flag is often useful.
AnsibleConfigFile = os.DevNull

// A test hook so we can take the args passed and transform them as needed.
cmdArgsTransform = func(input []string) []string {
return input
Expand Down Expand Up @@ -118,7 +130,11 @@ func (s *server) Run(ctx context.Context, req *pb.RunRequest) (*pb.RunReply, err

cmdArgs = cmdArgsTransform(cmdArgs)

run, err := util.RunCommand(ctx, AnsiblePlaybookBin, cmdArgs)
// Pin ANSIBLE_CONFIG so ansible does not auto-load ./ansible.cfg from the
// (untrusted) working directory or ~/.ansible.cfg from the home directory.
run, err := util.RunCommand(ctx, AnsiblePlaybookBin, cmdArgs,
util.EnvVar("ANSIBLE_CONFIG="+AnsibleConfigFile),
)
if err != nil {
recorder.CounterOrLog(ctx, ansibleRunFailureCounter, 1, attribute.String("reason", "run_err"))
return nil, err
Expand Down