7e4cffc5d2
* Change default file permissions so they are not world readable
CVE-2020-1736
Set the default permissions for files we create with atomic_move() to 0o0660. Track
which files we create that did not exist and warn if the module supports 'mode'
and it was not specified and the module did not call set_mode_if_different(). This allows the user to take action and specify a mode rather than using the defaults.
A code audit is needed to find all instances of modules that call atomic_move()
but do not call set_mode_if_different(). The findings need to be documented in
a changelog since we are not warning. Warning in those instances would be frustrating
to the user since they have no way to change the module code.
- use a set for storing list of created files
- just check the argument spac and params rather than using another property
- improve the warning message to include the default permissions.
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| _extensions | ||
| _static | ||
| _themes/sphinx_rtd_theme | ||
| js/ansible | ||
| rst | ||
| .gitignore | ||
| .nojekyll | ||
| ansible_2_5.inv | ||
| ansible_2_6.inv | ||
| ansible_2_7.inv | ||
| ansible_2_8.inv | ||
| ansible_2_9.inv | ||
| collection-plugins.yml | ||
| jinja2.inv | ||
| keyword_desc.yml | ||
| Makefile | ||
| Makefile.sphinx | ||
| modules.js | ||
| python2.inv | ||
| python3.inv | ||
| README.md | ||
| requirements.txt | ||
| variables.dot | ||
Ansible documentation
This project hosts the source behind docs.ansible.com.
To create clear, concise, and consistent contributions to Ansible documentation, please refer to the following information.
Contributions
Contributions to the documentation are welcome.
The Ansible community produces guidance on contributions, building documentation, and submitting pull requests, which you can find in Contributing to the Ansible Documentation.
You can also join the Docs Working Group.
Ansible style guide
Ansible documentation is written in ReStructuredText(RST). The Ansible style guide provides linguistic direction and technical guidelines for working with reStructuredText, in addition to other resources.
Tools
The Ansible community uses a range of tools and programs for working with Ansible documentation. Learn more about Other Tools and Programs in the Ansible Community Guide.
GitHub
Ansible documentation is hosted on the Ansible GitHub project. For GitHub workflows and other information, see the GitHub Guides.