Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

synchronize: fix to honor become_user when become_method sudo #187

Merged
merged 3 commits into from
Jul 8, 2021
Merged

synchronize: fix to honor become_user when become_method sudo #187

merged 3 commits into from
Jul 8, 2021

Conversation

smemsh
Copy link
Contributor

@smemsh smemsh commented May 12, 2021

SUMMARY

When become_method is sudo, the synchronize module ignores become_user, always running as root. This means one cannot create files as a target user, when they need to get in via a third user and can only sudo via that one. In my case, I'm connecting via a special provisioning user that has sudo privs, but I need to create the files as the become_user. I'm using it to deposit skeleton files, and there should be no reason to run another task with chown; after all, the documentation already describes the desired behavior:

The user and permissions for the synchronize dest are those of the remote_user on the destination host or the become_user if become=yes is active.

This patch takes the running become_user (if it's not None) and adds it to the sudo command with the -u command line option, so the file gets created correctly. I have tested this and it works.

Other become_methods are ignored, but they already were anyways (the code already has a TODO to add other methods, which we don't attempt in this patch)

Fixes #186

ISSUE TYPE
  • Bugfix Pull Request
COMPONENT NAME

synchronize

ADDITIONAL INFORMATION

See reproduction in #186.

This appears to have been in place since ansible/ansible@811a906

@smemsh
Copy link
Contributor Author

smemsh commented May 12, 2021

The changelog fragment apparently has to be in the last commit? That doesn't seem right. It means one can't add commits to the branch tip without an interactive rebase every time to reorder them. The command it's using to determine is:

shell: git show --name-status --exit-code --oneline --diff-filter=A | grep changelogs/fragments/

but shouldn't it use instead:

shell: git show {{basebranch}}.. --name-status --exit-code --oneline --diff-filter=A | grep changelogs/fragments/

I don't know the right name for the templated branch variable ie {{basebranch}}, but I would think it should be using that, so it's looking at the whole diff in the patch and not just the last commit. My changelog fragment was there and I had to reorder it to be the last commit just for the fragment detection rule to work.

@smemsh smemsh changed the title Fix to honor become_user in synchronize module (Fixes #186) synchronize: fix to honor become_user when become_method sudo May 12, 2021
Copy link
Contributor

@aminvakil aminvakil left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your contribution!
You're right about changelog fragment check bug, I can't find the repository to open an issue/PR to fix this bug right now.

changelogs/fragments/187-fix-synchronize-become-user.yml Outdated Show resolved Hide resolved
@smemsh
Copy link
Contributor Author

smemsh commented May 12, 2021

my patch was working fine, then after only a trivial change to changelog fragment was made, now this:

ERROR! Collection artifact at 'collections/cisco-nxos-2.2.1-dev4.tar.gz' is not a valid tar file.

not clear what that has to do with my patch?

@aminvakil
Copy link
Contributor

I would just ignore the CI :)
Feel free to close/reopen the PR to test again, as I've found some times which bot commands (rebuild_failed, recheck) does not work either.
Closing/reopening always work though ;)

@smemsh
Copy link
Contributor Author

smemsh commented May 13, 2021

the repository for CI bugs might be https://github.com/ansible/ansibullbot

@smemsh
Copy link
Contributor Author

smemsh commented May 13, 2021

recheck

@smemsh
Copy link
Contributor Author

smemsh commented May 13, 2021

FYI, don't see the changelog fragment detection code in ansibullbot repo anywhere, so it must be somewhere else

@Akasurde
Copy link
Member

Akasurde commented Jun 3, 2021

@quidame @aminvakil Could you please review this and let me know? Thanks in advance.

Copy link
Contributor

@aminvakil aminvakil left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Akasurde
Copy link
Member

Akasurde commented Jul 8, 2021

recheck

@Akasurde Akasurde added the gate Gate PR in Zuul CI (Obsolete: Please set "mergeit" instead of "gate") label Jul 8, 2021
@ansible-zuul ansible-zuul bot merged commit f6fa00b into ansible-collections:main Jul 8, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
gate Gate PR in Zuul CI (Obsolete: Please set "mergeit" instead of "gate")
Projects
None yet
Development

Successfully merging this pull request may close these issues.

synchronize module ignores become_user when become in effect
4 participants