Jérémie Astori
Matt Clay
parent
6482d1344a
commit
edf531efd7
1 changed files with 117 additions and 112 deletions
|
|
@ -79,6 +79,14 @@ options:
|
||||||
description:
|
description:
|
||||||
- DEPRECATED. The acl to set or remove. This must always be quoted in the form of '<etype>:<qualifier>:<perms>'. The qualifier may be empty for some types, but the type and perms are always requried. '-' can be used as placeholder when you do not care about permissions. This is now superseded by entity, type and permissions fields.
|
- DEPRECATED. The acl to set or remove. This must always be quoted in the form of '<etype>:<qualifier>:<perms>'. The qualifier may be empty for some types, but the type and perms are always requried. '-' can be used as placeholder when you do not care about permissions. This is now superseded by entity, type and permissions fields.
|
||||||
|
|
||||||
|
recursive:
|
||||||
|
version_added: "@@@"
|
||||||
|
required: false
|
||||||
|
default: no
|
||||||
|
choices: [ 'yes', 'no' ]
|
||||||
|
description:
|
||||||
|
- Recursively sets the specified ACL (added in Ansible @@@). Incompatible with C(state=query).
|
||||||
|
|
||||||
author: "Brian Coca (@bcoca)"
|
author: "Brian Coca (@bcoca)"
|
||||||
notes:
|
notes:
|
||||||
- The "acl" module requires that acls are enabled on the target filesystem and that the setfacl and getfacl binaries are installed.
|
- The "acl" module requires that acls are enabled on the target filesystem and that the setfacl and getfacl binaries are installed.
|
||||||
|
|
@ -110,20 +118,6 @@ acl:
|
||||||
sample: [ "user::rwx", "group::rwx", "other::rwx" ]
|
sample: [ "user::rwx", "group::rwx", "other::rwx" ]
|
||||||
'''
|
'''
|
||||||
|
|
||||||
def normalize_permissions(p):
|
|
||||||
perms = ['-','-','-']
|
|
||||||
for char in p:
|
|
||||||
if char == 'r':
|
|
||||||
perms[0] = 'r'
|
|
||||||
if char == 'w':
|
|
||||||
perms[1] = 'w'
|
|
||||||
if char == 'x':
|
|
||||||
perms[2] = 'x'
|
|
||||||
if char == 'X':
|
|
||||||
if perms[2] != 'x': # 'x' is more permissive
|
|
||||||
perms[2] = 'X'
|
|
||||||
return ''.join(perms)
|
|
||||||
|
|
||||||
def split_entry(entry):
|
def split_entry(entry):
|
||||||
''' splits entry and ensures normalized return'''
|
''' splits entry and ensures normalized return'''
|
||||||
|
|
||||||
|
|
@ -132,9 +126,9 @@ def split_entry(entry):
|
||||||
if len(a) == 3:
|
if len(a) == 3:
|
||||||
a.append(False)
|
a.append(False)
|
||||||
try:
|
try:
|
||||||
p,e,t,d = a
|
p, e, t, d = a
|
||||||
except ValueError, e:
|
except ValueError, e:
|
||||||
print "wtf?? %s => %s" % (entry,a)
|
print "wtf?? %s => %s" % (entry, a)
|
||||||
raise e
|
raise e
|
||||||
|
|
||||||
if d:
|
if d:
|
||||||
|
|
@ -151,69 +145,87 @@ def split_entry(entry):
|
||||||
else:
|
else:
|
||||||
t = None
|
t = None
|
||||||
|
|
||||||
p = normalize_permissions(p)
|
return [d, t, e, p]
|
||||||
|
|
||||||
return [d,t,e,p]
|
|
||||||
|
|
||||||
def get_acls(module,path,follow):
|
def build_entry(etype, entity, permissions=None):
|
||||||
|
'''Builds and returns an entry string. Does not include the permissions bit if they are not provided.'''
|
||||||
|
return etype + ':' + entity + (':' + permissions if permissions else '')
|
||||||
|
|
||||||
cmd = [ module.get_bin_path('getfacl', True) ]
|
|
||||||
if not follow:
|
def build_command(module, mode, path, follow, default, recursive, entry=''):
|
||||||
cmd.append('-h')
|
'''Builds and returns agetfacl/setfacl command.'''
|
||||||
# prevents absolute path warnings and removes headers
|
if mode == 'set':
|
||||||
|
cmd = [module.get_bin_path('setfacl', True)]
|
||||||
|
cmd.append('-m "%s"' % entry)
|
||||||
|
elif mode == 'rm':
|
||||||
|
cmd = [module.get_bin_path('setfacl', True)]
|
||||||
|
cmd.append('-x "%s"' % entry)
|
||||||
|
else: # mode == 'get'
|
||||||
|
cmd = [module.get_bin_path('getfacl', True)]
|
||||||
cmd.append('--omit-header')
|
cmd.append('--omit-header')
|
||||||
cmd.append('--absolute-names')
|
cmd.append('--absolute-names')
|
||||||
cmd.append(path)
|
|
||||||
|
|
||||||
return _run_acl(module,cmd)
|
if recursive:
|
||||||
|
cmd.append('--recursive')
|
||||||
|
|
||||||
def set_acl(module,path,entry,follow,default):
|
|
||||||
|
|
||||||
cmd = [ module.get_bin_path('setfacl', True) ]
|
|
||||||
if not follow:
|
|
||||||
cmd.append('-h')
|
|
||||||
if default:
|
|
||||||
cmd.append('-d')
|
|
||||||
cmd.append('-m "%s"' % entry)
|
|
||||||
cmd.append(path)
|
|
||||||
|
|
||||||
return _run_acl(module,cmd)
|
|
||||||
|
|
||||||
def rm_acl(module,path,entry,follow,default):
|
|
||||||
|
|
||||||
cmd = [ module.get_bin_path('setfacl', True) ]
|
|
||||||
if not follow:
|
if not follow:
|
||||||
cmd.append('-h')
|
cmd.append('-h')
|
||||||
|
|
||||||
if default:
|
if default:
|
||||||
|
if(mode == 'rm'):
|
||||||
cmd.append('-k')
|
cmd.append('-k')
|
||||||
entry = entry[0:entry.rfind(':')]
|
else: # mode == 'set' or mode == 'get'
|
||||||
cmd.append('-x "%s"' % entry)
|
cmd.append('-d')
|
||||||
|
|
||||||
cmd.append(path)
|
cmd.append(path)
|
||||||
|
return cmd
|
||||||
|
|
||||||
return _run_acl(module,cmd,False)
|
|
||||||
|
|
||||||
def _run_acl(module,cmd,check_rc=True):
|
def acl_changed(module, cmd):
|
||||||
|
'''Returns true if the provided command affects the existing ACLs, false otherwise.'''
|
||||||
|
cmd = cmd[:] # lists are mutables so cmd would be overriden without this
|
||||||
|
cmd.insert(1, '--test')
|
||||||
|
lines = run_acl(module, cmd)
|
||||||
|
return not all(line.endswith('*,*') for line in lines)
|
||||||
|
|
||||||
|
|
||||||
|
def run_acl(module, cmd, check_rc=True):
|
||||||
|
|
||||||
try:
|
try:
|
||||||
(rc, out, err) = module.run_command(' '.join(cmd), check_rc=check_rc)
|
(rc, out, err) = module.run_command(' '.join(cmd), check_rc=check_rc)
|
||||||
except Exception, e:
|
except Exception, e:
|
||||||
module.fail_json(msg=e.strerror)
|
module.fail_json(msg=e.strerror)
|
||||||
|
|
||||||
# trim last line as it is always empty
|
lines = out.splitlines()
|
||||||
ret = out.splitlines()
|
if lines and not lines[-1].split():
|
||||||
return ret[0:len(ret)-1]
|
# trim last line only when it is empty
|
||||||
|
return lines[:-1]
|
||||||
|
else:
|
||||||
|
return lines
|
||||||
|
|
||||||
|
|
||||||
def main():
|
def main():
|
||||||
module = AnsibleModule(
|
module = AnsibleModule(
|
||||||
argument_spec = dict(
|
argument_spec=dict(
|
||||||
name = dict(required=True,aliases=['path'], type='str'),
|
name=dict(required=True, aliases=['path'], type='str'),
|
||||||
entry = dict(required=False, etype='str'),
|
entry=dict(required=False, type='str'),
|
||||||
entity = dict(required=False, type='str', default=''),
|
entity=dict(required=False, type='str', default=''),
|
||||||
etype = dict(required=False, choices=['other', 'user', 'group', 'mask'], type='str'),
|
etype=dict(
|
||||||
permissions = dict(required=False, type='str'),
|
required=False,
|
||||||
state = dict(required=False, default='query', choices=[ 'query', 'present', 'absent' ], type='str'),
|
choices=['other', 'user', 'group', 'mask'],
|
||||||
follow = dict(required=False, type='bool', default=True),
|
type='str'
|
||||||
default= dict(required=False, type='bool', default=False),
|
),
|
||||||
|
permissions=dict(required=False, type='str'),
|
||||||
|
state=dict(
|
||||||
|
required=False,
|
||||||
|
default='query',
|
||||||
|
choices=['query', 'present', 'absent'],
|
||||||
|
type='str'
|
||||||
|
),
|
||||||
|
follow=dict(required=False, type='bool', default=True),
|
||||||
|
default=dict(required=False, type='bool', default=False),
|
||||||
|
recursive=dict(required=False, type='bool', default=False),
|
||||||
),
|
),
|
||||||
supports_check_mode=True,
|
supports_check_mode=True,
|
||||||
)
|
)
|
||||||
|
|
@ -226,79 +238,72 @@ def main():
|
||||||
state = module.params.get('state')
|
state = module.params.get('state')
|
||||||
follow = module.params.get('follow')
|
follow = module.params.get('follow')
|
||||||
default = module.params.get('default')
|
default = module.params.get('default')
|
||||||
|
recursive = module.params.get('recursive')
|
||||||
if permissions:
|
|
||||||
permissions = normalize_permissions(permissions)
|
|
||||||
|
|
||||||
if not os.path.exists(path):
|
if not os.path.exists(path):
|
||||||
module.fail_json(msg="path not found or not accessible!")
|
module.fail_json(msg="Path not found or not accessible.")
|
||||||
|
|
||||||
if state in ['present','absent']:
|
if state == 'query' and recursive:
|
||||||
if not entry and not etype:
|
module.fail_json(msg="'recursive' MUST NOT be set when 'state=query'.")
|
||||||
module.fail_json(msg="%s requires either etype and permissions or just entry be set" % state)
|
|
||||||
|
if not entry:
|
||||||
|
if state == 'absent' and permissions:
|
||||||
|
module.fail_json(msg="'permissions' MUST NOT be set when 'state=absent'.")
|
||||||
|
|
||||||
|
if state == 'absent' and not entity:
|
||||||
|
module.fail_json(msg="'entity' MUST be set when 'state=absent'.")
|
||||||
|
|
||||||
|
if state in ['present', 'absent'] and not etype:
|
||||||
|
module.fail_json(msg="'etype' MUST be set when 'state=%s'." % state)
|
||||||
|
|
||||||
if entry:
|
if entry:
|
||||||
if etype or entity or permissions:
|
if etype or entity or permissions:
|
||||||
module.fail_json(msg="entry and another incompatible field (entity, etype or permissions) are also set")
|
module.fail_json(msg="'entry' MUST NOT be set when 'entity', 'etype' or 'permissions' are set.")
|
||||||
if entry.count(":") not in [2,3]:
|
|
||||||
module.fail_json(msg="Invalid entry: '%s', it requires 3 or 4 sections divided by ':'" % entry)
|
if state == 'present' and entry.count(":") != 3:
|
||||||
|
module.fail_json(msg="'entry' MUST have 3 sections divided by ':' when 'state=present'.")
|
||||||
|
|
||||||
|
if state == 'absent' and entry.count(":") != 2:
|
||||||
|
module.fail_json(msg="'entry' MUST have 2 sections divided by ':' when 'state=absent'.")
|
||||||
|
|
||||||
default, etype, entity, permissions = split_entry(entry)
|
default, etype, entity, permissions = split_entry(entry)
|
||||||
|
|
||||||
changed=False
|
changed = False
|
||||||
msg = ""
|
msg = ""
|
||||||
currentacls = get_acls(module,path,follow)
|
|
||||||
|
|
||||||
if (state == 'present'):
|
if state == 'present':
|
||||||
matched = False
|
entry = build_entry(etype, entity, permissions)
|
||||||
for oldentry in currentacls:
|
command = build_command(
|
||||||
if oldentry.count(":") == 0:
|
module, 'set', path, follow,
|
||||||
continue
|
default, recursive, entry
|
||||||
old_default, old_type, old_entity, old_permissions = split_entry(oldentry)
|
)
|
||||||
if old_default == default:
|
changed = acl_changed(module, command)
|
||||||
if old_type == etype:
|
|
||||||
if etype in ['user', 'group']:
|
|
||||||
if old_entity == entity:
|
|
||||||
matched = True
|
|
||||||
if not old_permissions == permissions:
|
|
||||||
changed = True
|
|
||||||
break
|
|
||||||
else:
|
|
||||||
matched = True
|
|
||||||
if not old_permissions == permissions:
|
|
||||||
changed = True
|
|
||||||
break
|
|
||||||
if not matched:
|
|
||||||
changed=True
|
|
||||||
|
|
||||||
if changed and not module.check_mode:
|
if changed and not module.check_mode:
|
||||||
set_acl(module,path,':'.join([etype, str(entity), permissions]),follow,default)
|
run_acl(module, command)
|
||||||
msg="%s is present" % ':'.join([etype, str(entity), permissions])
|
msg = "%s is present" % entry
|
||||||
|
|
||||||
elif state == 'absent':
|
elif state == 'absent':
|
||||||
for oldentry in currentacls:
|
entry = build_entry(etype, entity)
|
||||||
if oldentry.count(":") == 0:
|
command = build_command(
|
||||||
continue
|
module, 'rm', path, follow,
|
||||||
old_default, old_type, old_entity, old_permissions = split_entry(oldentry)
|
default, recursive, entry
|
||||||
if old_default == default:
|
)
|
||||||
if old_type == etype:
|
changed = acl_changed(module, command)
|
||||||
if etype in ['user', 'group']:
|
|
||||||
if old_entity == entity:
|
|
||||||
changed=True
|
|
||||||
break
|
|
||||||
else:
|
|
||||||
changed=True
|
|
||||||
break
|
|
||||||
if changed and not module.check_mode:
|
if changed and not module.check_mode:
|
||||||
rm_acl(module,path,':'.join([etype, entity, '---']),follow,default)
|
run_acl(module, command, False)
|
||||||
msg="%s is absent" % ':'.join([etype, entity, '---'])
|
msg = "%s is absent" % entry
|
||||||
|
|
||||||
else:
|
else:
|
||||||
msg="current acl"
|
msg = "current acl"
|
||||||
|
|
||||||
if changed:
|
acl = run_acl(
|
||||||
currentacls = get_acls(module,path,follow)
|
module,
|
||||||
|
build_command(module, 'get', path, follow, default, recursive)
|
||||||
|
)
|
||||||
|
|
||||||
module.exit_json(changed=changed, msg=msg, acl=currentacls)
|
module.exit_json(changed=changed, msg=msg, acl=acl)
|
||||||
|
|
||||||
# import module snippets
|
# import module snippets
|
||||||
from ansible.module_utils.basic import *
|
from ansible.module_utils.basic import *
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue