atfork import warning should be suppressed when system_warnings = False

Fixes #9247

lib/ansible/runner/__init__.py

@@ -32,6 +32,7 @@ import pipes
 import jinja2
 import subprocess
 import getpass
+import warnings
 
 import ansible.constants as C
 import ansible.inventory
@@ -49,6 +50,7 @@ from ansible.module_common import ModuleReplacer
 from ansible.module_utils.splitter import split_args, unquote
 from ansible.cache import FactCache
 from ansible.utils import update_hash
+from ansible.utils.display_functions import *
 
 module_replacer = ModuleReplacer(strip_comments=False)
 
@@ -59,10 +61,26 @@ except ImportError:
 
 HAS_ATFORK=True
 try:
-    from Crypto.Random import atfork
+    # some versions of pycrypto may not have this?
+    from Crypto.pct_warnings import PowmInsecureWarning
 except ImportError:
-    HAS_ATFORK=False
+    PowmInsecureWarning = RuntimeWarning
 
+with warnings.catch_warnings(record=True) as warning_handler:
+    warnings.simplefilter("error", PowmInsecureWarning)
+    try:
+        from Crypto.Random import atfork
+    except PowmInsecureWarning:
+        system_warning(
+            "The version of gmp you have installed has a known issue regarding " + \
+            "timing vulnerabilities when used with pycrypto. " + \
+            "If possible, you should update it (ie. yum update gmp)."
+        )
+        warnings.resetwarnings()
+        warnings.simplefilter("ignore")
+        HAS_ATFORK=False
+    except ImportError:
+        HAS_ATFORK=False
 multiprocessing_runner = None
 
 OUTPUT_LOCKFILE  = tempfile.TemporaryFile()