Re: [PATCH] update_ssh_config_guestfs: fix incorrect task privilege

[Chuck Lever <chuck.lever@oracle.com>]

On 5/20/25 3:43 AM, Daniel Gomez wrote:
> From: Daniel Gomez <da.gomez@samsung.com>
> 
> This task does not require elevated privileges, so become: true is
> unnecessary and can be removed. Its use was also causing the task to run
> as root (the default become_user [1]), which led to the following error:
> 
> task path:
> /home/cel/src/kdevops/buildbot-configs/playbooks/roles/
> update_ssh_config_guestfs/tasks/main.yml:73
> fatal: [localhost]: FAILED! => {
>     "changed": false,
>     "path": "/root/.ssh/config",
>     "state": "absent"
> }
> 
> MSG:
> 
> file (/root/.ssh/config) is absent, cannot continue
> 
> Ensure the task is only run when the conditions are appropiate, i.e.
> when the file exists.
> 
> [1]
> https://docs.ansible.com/ansible/latest/playbook_guide/
> playbooks_privilege_escalation.html#become-directives
> 
> Fixes f301c9a ("guestfs: ensure right permissions for ssh config")
> 
> Reported-by: Chuck Lever <chuck.lever@oracle.com>
> Closes: https://lore.kernel.org/all/b2fb6337-f737-4ab9-94a5-f6d5d94db749@oracle.com/
> Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
> ---
>  playbooks/roles/update_ssh_config_guestfs/tasks/main.yml | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml b/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
> index 6c6c49034d8a0313cda5fd5ca673093f1a8054cf..6606a6c6b0e9393d5d3b455d5d0c3851636e2c59 100644
> --- a/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
> +++ b/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
> @@ -71,9 +71,7 @@
>        Include ~/.ssh/config_kdevops_*
>  
>  - name: Ensure ~/.ssh/config permissions
> -  become: true
> -  become_flags: 'su - -c'
> -  become_method: ansible.builtin.sudo
>    ansible.builtin.file:
>      path: ~/.ssh/config
>      mode: "0600"
> +  when: ssh_config.stat.exists
> 
> ---
> base-commit: 3eaf4e7dd4fedff773d7ca1882329109b133911f
> change-id: 20250520-fix-update_ssh_config_guestfs-10e989459fc4
> 
> Best regards,

Reviewed-by: Chuck Lever <chuck.lever@oracle.com>

  or

Tested-by: Chuck Lever <chuck.lever@oracle.com>

Take your pick!

-- 
Chuck Lever