Re: [PATCH] update_ssh_config_guestfs: fix incorrect task privilege

[Daniel Gomez <da.gomez@kernel.org>]

On 20/05/2025 15.21, Chuck Lever wrote:
> On 5/20/25 3:43 AM, Daniel Gomez wrote:
>> From: Daniel Gomez <da.gomez@samsung.com>
>>
>> This task does not require elevated privileges, so become: true is
>> unnecessary and can be removed. Its use was also causing the task to run
>> as root (the default become_user [1]), which led to the following error:
>>
>> task path:
>> /home/cel/src/kdevops/buildbot-configs/playbooks/roles/
>> update_ssh_config_guestfs/tasks/main.yml:73
>> fatal: [localhost]: FAILED! => {
>>      "changed": false,
>>      "path": "/root/.ssh/config",
>>      "state": "absent"
>> }
>>
>> MSG:
>>
>> file (/root/.ssh/config) is absent, cannot continue
>>
>> Ensure the task is only run when the conditions are appropiate, i.e.
>> when the file exists.
>>
>> [1]
>> https://docs.ansible.com/ansible/latest/playbook_guide/
>> playbooks_privilege_escalation.html#become-directives
>>
>> Fixes f301c9a ("guestfs: ensure right permissions for ssh config")
>>
>> Reported-by: Chuck Lever <chuck.lever@oracle.com>
>> Closes: https://lore.kernel.org/all/b2fb6337-f737-4ab9-94a5-f6d5d94db749@oracle.com/
>> Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
>> ---
>>   playbooks/roles/update_ssh_config_guestfs/tasks/main.yml | 4 +---
>>   1 file changed, 1 insertion(+), 3 deletions(-)
>>
>> diff --git a/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml b/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
>> index 6c6c49034d8a0313cda5fd5ca673093f1a8054cf..6606a6c6b0e9393d5d3b455d5d0c3851636e2c59 100644
>> --- a/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
>> +++ b/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
>> @@ -71,9 +71,7 @@
>>         Include ~/.ssh/config_kdevops_*
>>   
>>   - name: Ensure ~/.ssh/config permissions
>> -  become: true
>> -  become_flags: 'su - -c'
>> -  become_method: ansible.builtin.sudo
>>     ansible.builtin.file:
>>       path: ~/.ssh/config
>>       mode: "0600"
>> +  when: ssh_config.stat.exists
>>
>> ---
>> base-commit: 3eaf4e7dd4fedff773d7ca1882329109b133911f
>> change-id: 20250520-fix-update_ssh_config_guestfs-10e989459fc4
>>
>> Best regards,
> 
> Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
> 
>    or
> 
> Tested-by: Chuck Lever <chuck.lever@oracle.com>
> 
> Take your pick!

b4 picked the best option: both.

Applied, thanks!