[PATCH] update_ssh_config_guestfs: fix incorrect task privilege

[PATCH] update_ssh_config_guestfs: fix incorrect task privilege

[Daniel Gomez]

From: Daniel Gomez <da.gomez@samsung.com>

This task does not require elevated privileges, so become: true is
unnecessary and can be removed. Its use was also causing the task to run
as root (the default become_user [1]), which led to the following error:

task path:
/home/cel/src/kdevops/buildbot-configs/playbooks/roles/
update_ssh_config_guestfs/tasks/main.yml:73
fatal: [localhost]: FAILED! => {
    "changed": false,
    "path": "/root/.ssh/config",
    "state": "absent"
}

MSG:

file (/root/.ssh/config) is absent, cannot continue

Ensure the task is only run when the conditions are appropiate, i.e.
when the file exists.

[1]
https://docs.ansible.com/ansible/latest/playbook_guide/
playbooks_privilege_escalation.html#become-directives

Fixes f301c9a ("guestfs: ensure right permissions for ssh config")

Reported-by: Chuck Lever <chuck.lever@oracle.com>
Closes: https://lore.kernel.org/all/b2fb6337-f737-4ab9-94a5-f6d5d94db749@oracle.com/
Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
---
 playbooks/roles/update_ssh_config_guestfs/tasks/main.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml b/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
index 6c6c49034d8a0313cda5fd5ca673093f1a8054cf..6606a6c6b0e9393d5d3b455d5d0c3851636e2c59 100644
--- a/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
+++ b/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
@@ -71,9 +71,7 @@
       Include ~/.ssh/config_kdevops_*
 
 - name: Ensure ~/.ssh/config permissions
-  become: true
-  become_flags: 'su - -c'
-  become_method: ansible.builtin.sudo
   ansible.builtin.file:
     path: ~/.ssh/config
     mode: "0600"
+  when: ssh_config.stat.exists

---
base-commit: 3eaf4e7dd4fedff773d7ca1882329109b133911f
change-id: 20250520-fix-update_ssh_config_guestfs-10e989459fc4

Best regards,
-- 
Daniel Gomez <da.gomez@samsung.com>

Re: [PATCH] update_ssh_config_guestfs: fix incorrect task privilege

[Chuck Lever]

On 5/20/25 3:43 AM, Daniel Gomez wrote:
> From: Daniel Gomez <da.gomez@samsung.com>
> 
> This task does not require elevated privileges, so become: true is
> unnecessary and can be removed. Its use was also causing the task to run
> as root (the default become_user [1]), which led to the following error:
> 
> task path:
> /home/cel/src/kdevops/buildbot-configs/playbooks/roles/
> update_ssh_config_guestfs/tasks/main.yml:73
> fatal: [localhost]: FAILED! => {
>     "changed": false,
>     "path": "/root/.ssh/config",
>     "state": "absent"
> }
> 
> MSG:
> 
> file (/root/.ssh/config) is absent, cannot continue
> 
> Ensure the task is only run when the conditions are appropiate, i.e.
> when the file exists.
> 
> [1]
> https://docs.ansible.com/ansible/latest/playbook_guide/
> playbooks_privilege_escalation.html#become-directives
> 
> Fixes f301c9a ("guestfs: ensure right permissions for ssh config")
> 
> Reported-by: Chuck Lever <chuck.lever@oracle.com>
> Closes: https://lore.kernel.org/all/b2fb6337-f737-4ab9-94a5-f6d5d94db749@oracle.com/
> Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
> ---
>  playbooks/roles/update_ssh_config_guestfs/tasks/main.yml | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml b/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
> index 6c6c49034d8a0313cda5fd5ca673093f1a8054cf..6606a6c6b0e9393d5d3b455d5d0c3851636e2c59 100644
> --- a/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
> +++ b/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
> @@ -71,9 +71,7 @@
>        Include ~/.ssh/config_kdevops_*
>  
>  - name: Ensure ~/.ssh/config permissions
> -  become: true
> -  become_flags: 'su - -c'
> -  become_method: ansible.builtin.sudo
>    ansible.builtin.file:
>      path: ~/.ssh/config
>      mode: "0600"
> +  when: ssh_config.stat.exists
> 
> ---
> base-commit: 3eaf4e7dd4fedff773d7ca1882329109b133911f
> change-id: 20250520-fix-update_ssh_config_guestfs-10e989459fc4
> 
> Best regards,

Reviewed-by: Chuck Lever <chuck.lever@oracle.com>

  or

Tested-by: Chuck Lever <chuck.lever@oracle.com>

Take your pick!

-- 
Chuck Lever

Re: [PATCH] update_ssh_config_guestfs: fix incorrect task privilege

[Daniel Gomez]

On 20/05/2025 15.21, Chuck Lever wrote:
> On 5/20/25 3:43 AM, Daniel Gomez wrote:
>> From: Daniel Gomez <da.gomez@samsung.com>
>>
>> This task does not require elevated privileges, so become: true is
>> unnecessary and can be removed. Its use was also causing the task to run
>> as root (the default become_user [1]), which led to the following error:
>>
>> task path:
>> /home/cel/src/kdevops/buildbot-configs/playbooks/roles/
>> update_ssh_config_guestfs/tasks/main.yml:73
>> fatal: [localhost]: FAILED! => {
>>      "changed": false,
>>      "path": "/root/.ssh/config",
>>      "state": "absent"
>> }
>>
>> MSG:
>>
>> file (/root/.ssh/config) is absent, cannot continue
>>
>> Ensure the task is only run when the conditions are appropiate, i.e.
>> when the file exists.
>>
>> [1]
>> https://docs.ansible.com/ansible/latest/playbook_guide/
>> playbooks_privilege_escalation.html#become-directives
>>
>> Fixes f301c9a ("guestfs: ensure right permissions for ssh config")
>>
>> Reported-by: Chuck Lever <chuck.lever@oracle.com>
>> Closes: https://lore.kernel.org/all/b2fb6337-f737-4ab9-94a5-f6d5d94db749@oracle.com/
>> Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
>> ---
>>   playbooks/roles/update_ssh_config_guestfs/tasks/main.yml | 4 +---
>>   1 file changed, 1 insertion(+), 3 deletions(-)
>>
>> diff --git a/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml b/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
>> index 6c6c49034d8a0313cda5fd5ca673093f1a8054cf..6606a6c6b0e9393d5d3b455d5d0c3851636e2c59 100644
>> --- a/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
>> +++ b/playbooks/roles/update_ssh_config_guestfs/tasks/main.yml
>> @@ -71,9 +71,7 @@
>>         Include ~/.ssh/config_kdevops_*
>>   
>>   - name: Ensure ~/.ssh/config permissions
>> -  become: true
>> -  become_flags: 'su - -c'
>> -  become_method: ansible.builtin.sudo
>>     ansible.builtin.file:
>>       path: ~/.ssh/config
>>       mode: "0600"
>> +  when: ssh_config.stat.exists
>>
>> ---
>> base-commit: 3eaf4e7dd4fedff773d7ca1882329109b133911f
>> change-id: 20250520-fix-update_ssh_config_guestfs-10e989459fc4
>>
>> Best regards,
> 
> Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
> 
>    or
> 
> Tested-by: Chuck Lever <chuck.lever@oracle.com>
> 
> Take your pick!

b4 picked the best option: both.

Applied, thanks!