Merge 3c881c61fa into b39ee97ccc

docs: fix broken badge and restore coverage badge

SUMMARY
Replaced the outdated Shippable badge and active Codecov coverage badge, like other repos in ansible-collections org
ISSUE TYPE


Docs Pull Request

COMPONENT NAME

ADDITIONAL INFORMATION

Reviewed-by: Hideki Saito <saito@fgrep.org>

README.md

@@ -2,7 +2,7 @@
 <!-- Add CI and code coverage badges here. Samples included below. -->
 [![Build Status](
 https://dev.azure.com/ansible/ansible.posix/_apis/build/status/CI?branchName=main)](https://dev.azure.com/ansible/ansible.posix/_build?definitionId=26)
-[![Run Status](https://api.shippable.com/projects/5e669aaf8b17a60007e4d18d/badge?branch=main)]() <!--[![Codecov](https://img.shields.io/codecov/c/github/ansible-collections/ansible.posix)](https://codecov.io/gh/ansible-collections/ansible.posix)-->
+[![Codecov](https://img.shields.io/codecov/c/github/ansible-collections/ansible.posix)](https://codecov.io/gh/ansible-collections/ansible.posix)
 
 ## Communication
 

changelogs/fragments/639_fix_authorized_key.yml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - ansible.posix.authorized_key - fixes error on permission denied in authorized_key module (https://github.com/ansible-collections/ansible.posix/issues/462).

plugins/modules/acl.py

@@ -211,8 +211,11 @@ def build_command(module, mode, path, follow, default, recursive, recalculate_ma
                 cmd.append('--absolute-names')
             cmd.append('--omit-header')
 
-    if recursive and not use_nfsv4_acls:
-        cmd.append('--recursive')
+    if recursive:
+        if use_nfsv4_acls:
+            cmd.append('-R')  # Add recursive flag for NFSv4 ACLs
+        else:
+            cmd.append('--recursive')
 
     if recalculate_mask == 'mask' and mode in ['set', 'rm']:
         cmd.append('--mask')
@@ -226,13 +229,18 @@ def build_command(module, mode, path, follow, default, recursive, recalculate_ma
             cmd.append('-h')
 
     if default:
-        cmd.insert(1, '-d')
+        if not use_nfsv4_acls:
+            cmd.insert(1, '-d')
+        elif mode == 'set':
+            # For NFSv4 ACLs, handle default ACLs through the entry format or other means
+            # This is a placeholder for NFSv4 default ACL handling
+            pass
 
     cmd.append(path)
     return cmd
 
 
-def acl_changed(module, cmd, entry, use_nfsv4_acls=False):
+def acl_changed(module, cmd, entry, recursive=False, use_nfsv4_acls=False):
     '''Returns true if the provided command affects the existing ACLs, false otherwise.'''
     # To check the ACL changes, use the output of setfacl or nfs4_setfacl with '--test'.
     # FreeBSD do not have a --test flag, so by default, it is safer to always say "true".
@@ -247,6 +255,18 @@ def acl_changed(module, cmd, entry, use_nfsv4_acls=False):
         if line.endswith('*,*') and not use_nfsv4_acls:
             return False
         # if use_nfsv4_acls and entry is listed
+        if use_nfsv4_acls:
+            # For NFSv4 ACLs, ensure the entry is checked against the actual ACLs
+            for line in lines:
+                if recursive:
+                    # In recursive mode, ensure all entries match
+                    if entry not in line:
+                        return True
+                else:
+                    if entry in line:
+                        return False
+            return True
+
         if use_nfsv4_acls and entry == line:
             counter += 1
 
@@ -371,7 +391,7 @@ def main():
             module, 'set', path, follow,
             default, recursive, recalculate_mask, use_nfsv4_acls, entry
         )
-        changed = acl_changed(module, command, entry, use_nfsv4_acls)
+        changed = acl_changed(module, command, entry, recursive, use_nfsv4_acls)
 
         if changed and not module.check_mode:
             run_acl(module, command)
@@ -386,7 +406,7 @@ def main():
             module, 'rm', path, follow,
             default, recursive, recalculate_mask, use_nfsv4_acls, entry
         )
-        changed = acl_changed(module, command, entry, use_nfsv4_acls)
+        changed = acl_changed(module, command, entry, recursive, use_nfsv4_acls)
 
         if changed and not module.check_mode:
             run_acl(module, command, False)

plugins/modules/authorized_key.py

@@ -225,6 +225,8 @@ import os.path
 import tempfile
 import re
 import shlex
+import errno
+import traceback
 from operator import itemgetter
 
 from ansible.module_utils._text import to_native
@@ -475,16 +477,18 @@ def parsekey(module, raw_key, rank=None):
     return (key, key_type, options, comment, rank)
 
 
-def readfile(filename):
-
-    if not os.path.isfile(filename):
-        return ''
-
-    f = open(filename)
+def readfile(module, filename):
     try:
-        return f.read()
-    finally:
-        f.close()
+        with open(filename, 'r') as f:
+            return f.read()
+    except IOError as e:
+        if e.errno == errno.EACCES:
+            module.fail_json(msg="Permission denied on file or path for authorized keys file: %s" % filename,
+                             exception=traceback.format_exc())
+        elif e.errno == errno.ENOENT:
+            return ''
+        else:
+            raise
 
 
 def parsekeys(module, lines):
@@ -597,7 +601,7 @@ def enforce_state(module, params):
     # check current state -- just get the filename, don't create file
     do_write = False
     params["keyfile"] = keyfile(module, user, do_write, path, manage_dir)
-    existing_content = readfile(params["keyfile"])
+    existing_content = readfile(module, params["keyfile"])
     existing_keys = parsekeys(module, existing_content)
 
     # Add a place holder for keys that should exist in the state=present and

tests/integration/targets/authorized_key/tasks/check_permissions.yml

@@ -0,0 +1,41 @@
+---
+# -------------------------------------------------------------
+# check permissions
+
+- name: Create a file that is not accessible
+  ansible.builtin.file:
+    state: touch
+    path: "{{ output_dir | expanduser }}/file_permissions"
+    owner: root
+    mode: '0000'
+
+- name: Create unprivileged user
+  ansible.builtin.user:
+    name: nopriv
+    create_home: true
+
+- name: Try to delete a key from an unreadable file
+  become: true
+  become_user: nopriv
+  ansible.posix.authorized_key:
+    user: root
+    key: "{{ dss_key_basic }}"
+    state: absent
+    path: "{{ output_dir | expanduser }}/file_permissions"
+  register: result
+  ignore_errors: true
+
+- name: Assert that the key deletion has failed
+  ansible.builtin.assert:
+    that:
+      - result is failed
+
+- name: Remove the file
+  ansible.builtin.file:
+    state: absent
+    path: "{{ output_dir | expanduser }}/file_permissions"
+
+- name: Remove the user
+  ansible.builtin.user:
+    name: nopriv
+    state: absent

tests/integration/targets/authorized_key/tasks/main.yml

@@ -34,3 +34,6 @@
 
 - name: Test for specifying key as a path
   ansible.builtin.import_tasks: check_path.yml
+
+- name: Test for permission denied files
+  ansible.builtin.import_tasks: check_permissions.yml