ansible.posix.mount: add absent_from_fstab option
SUMMARY
Add absent_from_fstab option to remove the entry from fstab, but not unmount or delete the folder. Ideally this would have been the behavior of absent (as to mirror the behavior of present), but for backward compatibility I added a new verbose state
ISSUE TYPE
Feature Pull Request
COMPONENT NAME
mount
ADDITIONAL INFORMATION
Sometimes you may not want to delete the mountpoint (e.g. if it is not currently mounted and data is in the directory, the current behavior will simply error).
Reviewed-by: Amin Vakil <None>
Reviewed-by: None <None>
Fixes#390. Hosts involved must have same password
SUMMARY
Fixes#390
The change takes the password from destination hostvars ansible_ssh_pass or ansible_password when dest is remote.
In other case, previous behavior is maintained and password is taken form task vars ansible_ssh_pass or ansible_password.
Also, both user and password are templated to allow jinja expressions in them.
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
ansible.posix.synchronize
ADDITIONAL INFORMATION
n/a
Reviewed-by: Adam Miller <admiller@redhat.com>
More complete missing lib msg
adds 'exact' python used by module and hostname to avoid confusion
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
firewalld
Reviewed-by: Hideki Saito <saito@fgrep.org>
Replace distutils with included module in ansible-core 2.12 to address PEP 632
SUMMARY
Replace distutils.* with included module in ansible-core 2.12 to addresss PEP 632 if available.
It does not change the behavior of ansible-core 2.11 or earlier.
Fixes#303
Addresses PEP 632(https://www.python.org/dev/peps/pep-0632/)
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
plugins/module_utils/firewalld.py
plugins/modules/firewalld_info.py
ADDITIONAL INFORMATION
None
Reviewed-by: Andrew Klychkov <aaklychkov@mail.ru>
Reviewed-by: Hideki Saito <saito@fgrep.org>
Reviewed-by: Felix Fontein <felix@fontein.de>
Reviewed-by: None <None>
In modern systems (RHEL8+) with python3 default the library requirement is `python3-libsemanage`.
Updated `libsemanage-python` to `python3-libsemanage`.
Remove deprecated option from nfs mount example
SUMMARY
This removes the intr option from the documentation example for nfs mounts.
ISSUE TYPE
Docs Pull Request
COMPONENT NAME
mount.py
ADDITIONAL INFORMATION
According to the nfs manpage the intr/ nointr option has been deprecated with Kernel 2.6.25 which was released in April 2008 wiki
Even RHEL 6.10 which is already on Extended life cycle support is using a newer 2.6 Kernel. https://access.redhat.com/articles/3078
This does not change any module functionality. It simply removes the option from the nfs mount example.
Reviewed-by: None <None>
Whitespace in fully path to playbook causes rsync to fail
Any whitespace in path to playbook directory causes rsync to incorrectly chdir fail to correctly run.
SUMMARY
Any whitespace in path to playbook directory causes rsync to incorrectly chdir fail to correctly run.
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
ansible.posix.synchronize
ADDITIONAL INFORMATION
Example :
cd "/home/a/ansible plays"
task:
- synchronize:
src: a
dest: b
Results in the following error being thrown
fatal: [remote-host]: FAILED! => {"changed": false, "cmd": "/usr/bin/rsync --delay-updates -F --compress --archive --rsh='/usr/bin/ssh -S none -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null' --rsync-path='sudo -u root rsync' --out-format='<<CHANGED>>%i %n%L' /home/a/ansible plays/deployments// remote-user@remote-host:/b/", "msg": "rsync: [sender] link_stat \"/home/a/ansible\" failed: No such file or directory (2)\nrsync: [sender] change_dir \"/home/a/ansible plays/plays/a/\" failed: No such file or directory (2)\nrsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1330) [sender=3.2.3]\n", "rc": 23}
Reviewed-by: Hideki Saito <saito@fgrep.org>
Reviewed-by: Abhijeet Kasurde <None>
Reviewed-by: None <None>
Example :
cd "/home/a/ansible plays"
task:
- synchronize:
src: a
dest: b
Results in the following error being thrown
fatal: [remote-host]: FAILED! => {"changed": false, "cmd": "/usr/bin/rsync --delay-updates -F --compress --archive --rsh='/usr/bin/ssh -S none -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null' --rsync-path='sudo -u root rsync' --out-format='<<CHANGED>>%i %n%L' /home/a/ansible plays/deployments// remote-user@remote-host:/data/", "msg": "rsync: [sender] link_stat \"/home/a/ansible\" failed: No such file or directory (2)\nrsync: [sender] change_dir \"/home/a/ansible plays/plays/a/\" failed: No such file or directory (2)\nrsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1330) [sender=3.2.3]\n", "rc": 23}
- Remove centos6 platforms for integration tests on
the ansible devel branch from the azure-pipelines.
- Add delegate_to to each task of integration test for
synchronized module on devel branch
- Modify invalid parameter test to use key instead of name
for sysctl module
- Replace lookup plugin to slurp module in integration tests
for selinux module
- Add creating working directory task in integration tests
for acl module
Signed-off-by: Hideki Saito <saito@fgrep.org>
selinux: update kernel boot params when disabling/re-enabling SELinux
SUMMARY
The ability to disable SELinux from userspace based on the configuration
file is being deprecated in favor of the selinux=0 kernel boot
parameter. (Note that this affects only the "full" disable; switching
to/from permissive mode will work the same as before.)
Therefore, enhance the selinux module to try to set/unset the kernel
command-line parameter using grubby when enabling/disabling SELinux.
If the grubby package is not present on the system, the module will only
update the config file and report a warning. Note that even with the
runtime disable functionality removed, setting SELINUX=disabled in the
config file will lead to a system with no SELinux policy loaded, which
will behave in a very similar way as if SELinux was fully disabled, only
there could still be some minor performance impact, since the kernel
hooks will still be active.
More information:
https://lore.kernel.org/selinux/157836784986.560897.13893922675143903084.stgit@chester/https://fedoraproject.org/wiki/Changes/Remove_Support_For_SELinux_Runtime_Disable
ISSUE TYPE
Feature Pull Request
COMPONENT NAME
selinux module
Reviewed-by: Adam Miller <maxamillion@fedoraproject.org>
Reviewed-by: Ondrej Mosnáček <omosnacek@gmail.com>
Reviewed-by: Abhijeet Kasurde <None>
Reviewed-by: quidame <None>
Reviewed-by: Hideki Saito <saito@fgrep.org>
Reviewed-by: None <None>
The ability to disable SELinux from userspace based on the configuration
file is being deprecated in favor of the selinux=0 kernel boot
parameter. (Note that this affects only the "full" disable; switching
to/from permissive mode will work the same as before.)
Therefore, add an 'update_kernel_param' module parameter that will cause
it to set/unset the kernel command-line parameter using grubby when
enabling/disabling SELinux. (An explicit parameter was chosen for
backwards compatibility.)
More information:
https://lore.kernel.org/selinux/157836784986.560897.13893922675143903084.stgit@chester/https://fedoraproject.org/wiki/Changes/Remove_Support_For_SELinux_Runtime_Disable
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Fix requires firewalld version in comments for permanent parameter.
SUMMARY
Version of firewalled seems to be wrong. 3.0.9 version of that package does not exist.
The latest release of firewalled: https://github.com/firewalld/firewalld/releases
ISSUE TYPE
Docs Pull Request
COMPONENT NAME
ansible.posix.firewalld
Reviewed-by: Hideki Saito <saito@fgrep.org>
Reviewed-by: Andrew Klychkov <aaklychkov@mail.ru>
Reviewed-by: None <None>
Properly quote Synchronize
SUMMARY
The synchronize action plugin and module were a bit sloppy when it came to the command-line parameter quoting and that caused failure on some systems (for example, on Fedora 34).
This commit makes sure any arguments with potentially problematic characters are quoted before being used.
Fixes#242
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
synchronize
Reviewed-by: Sergey <None>
Reviewed-by: Abhijeet Kasurde <None>
Reviewed-by: None <None>
The synchronize action plugin and module were a bit sloppy when it
came to the command-line parameter quoting and that caused failuer on
some systems (for example, on Fedora 34).
This commit makes sure any argumnts with potentially problematic
characters are quoted before being used.
Add new firewalld_info module to ansible.posix collection
SUMMARY
Add new firewalld_info module to ansible.posix collection.
Gathering information about firewalld zone settings
fixes#98
ISSUE TYPE
Feature Pull Request
COMPONENT NAME
ansible.posix.firewalld_info
ADDITIONAL INFORMATION
None
Reviewed-by: Abhijeet Kasurde <None>
Reviewed-by: Hideki Saito <saito@fgrep.org>
synchronize: fix to honor become_user when become_method sudo
SUMMARY
When become_method is sudo, the synchronize module ignores become_user, always running as root. This means one cannot create files as a target user, when they need to get in via a third user and can only sudo via that one. In my case, I'm connecting via a special provisioning user that has sudo privs, but I need to create the files as the become_user. I'm using it to deposit skeleton files, and there should be no reason to run another task with chown; after all, the documentation already describes the desired behavior:
The user and permissions for the synchronize dest are those of the remote_user on the destination host or the become_user if become=yes is active.
This patch takes the running become_user (if it's not None) and adds it to the sudo command with the -u command line option, so the file gets created correctly. I have tested this and it works.
Other become_methods are ignored, but they already were anyways (the code already has a TODO to add other methods, which we don't attempt in this patch)
Fixes#186
ISSUE TYPE
Bugfix Pull Request
COMPONENT NAME
synchronize
ADDITIONAL INFORMATION
See reproduction in #186.
This appears to have been in place since ansible/ansible@811a906
Reviewed-by: Amin Vakil <info@aminvakil.com>
Reviewed-by: Sumit Jaiswal <sjaiswal@redhat.com>
Restructure integration tests for authorized_key module
SUMMARY
Split the large tasks/main.yml in integration tests to each function block and use import_tasks to import for them.
ISSUE TYPE
Feature Pull Request
COMPONENT NAME
tests/integration/targets/authorized_key/
ADDITIONAL INFORMATION
None
* Address the issue #28
* Modified behavior to set noauto option if boot is 'no' on Linux system
* Modified integration test to use filesize module instead of dd
Signed-off-by: Hideki Saito <saito@fgrep.org>
The synchronize action plugin has a built-in list of connection
plugins that it knows how to handle.
One of those connection plugins is the docker connection plugin. And
because the docker content has been moved around quite a lot, the
docker connection plugin has quite a few names:
- docker in Ansible 2.9,
- community.general.docker for community.general < 2.0.0, and
- community.docker.docker since a few months ago.
And while the synchronize module already knew about the first two
names, the last one was still missing. This commit fixes that omission
and adds a third name into the mix.
* firewalld: add zone target set
Fixes https://github.com/ansible/ansible/issues/49232
Signed-off-by: Adam Miller <admiller@redhat.com>
* fix sanity tests, add example of zone target setting
Signed-off-by: Adam Miller <admiller@redhat.com>
* test different zone/target combination as we're not hitting default settings
Signed-off-by: Adam Miller <admiller@redhat.com>
* fix enabled values for zone operations
Signed-off-by: Adam Miller <admiller@redhat.com>
* Apply suggestions from code review
Co-authored-by: Felix Fontein <felix@fontein.de>
Co-authored-by: Felix Fontein <felix@fontein.de>
Run add_docs.py
Run antsibull-changelog; backfill for prior releases
Bump release in galaxy.yml
Add .keep to changelogs/fragments so directory is not deleted if
`keep_fragments` is ever set to False.
Previously check_mode would incorrectly return changed=False even when a
change would have taken place if ran without check_mode, with
integration tests that confirmed this incorrect behavior. Also the
module did not correctly populate the return values when run in
check_mode. Both of these issues are resolved in this PR.
Fixes https://github.com/ansible-collections/ansible.posix/issues/37
Signed-off-by: Adam Miller <admiller@redhat.com>
In Ansible 2.9 (pre 2.10 routing), the AnsiballZ creation of the payload
will add an extra directory to the module_util path because ismount.py
shares the same name as it's parent dir which creates an inconsistency
in the payload creation. This causes the Collection module
ansible.posix.mount to work in Ansible 2.10 but not 2.9, with this pull
request a simple renaming of the module_util which side steps this
inconsistency.
Fixes https://github.com/ansible-collections/ansible.posix/issues/21
Signed-off-by: Adam Miller <admiller@redhat.com>
Previously the selinux module would only edit the state of found
configuration keys SELINUX and SELINUXTYPE in /etc/selinux/config but
would not add them with desired state if they were not found.
Fixes#23https://github.com/ansible-collections/ansible.posix/issues/23
Signed-off-by: Adam Miller <admiller@redhat.com>
