ansible-sshd/tests/tasks/backup.yml

28 lines
796 B
YAML
Raw Normal View History

---
- name: Setup
2022-06-03 12:22:17 +02:00
ansible.builtin.include_tasks: setup.yml
- name: Create a temporary directory for backup files
2022-06-03 12:22:17 +02:00
ansible.builtin.tempfile:
state: directory
register: __sshd_test_backup
changed_when: false
when:
- sshd_test_backup_skip is not defined
- name: Backup files
2022-06-03 12:22:17 +02:00
ansible.builtin.shell: |
if set -o | grep pipefail 2>&1 /dev/null ; then
set -o pipefail
fi
set -eu
fix: use quote with command, shell and validate with variable (#298) * robustness: quote test backup/restore file names This avoids issues if file names are not safepaths. * security: use quote with command, shell and validate with variable Skip quotation only if variable is checked. Add test suit to excercise some quote use cases. * robustness: fail if systemd.unit could have something in need of quote Ensure systemd.unit contents is robust. This disables possibility to have something that needs to be quoted there. But as ansible lacks proper way to quote systemd unit files (see man systemd.syntax, rules are not shell rules), it is better to fail such configs. If you are trying to do that, you are doing it wrong anyway or have malicious intent. Also ensure similar issue with sysctl.conf. Issue can be seen with `tests_hostkeys_unsafe_path.yml`, when adding following to role params: sshd_install_service: true sshd_config_file: "{{ ansible_facts.env.TMPDIR }}/sshd.d/foo.conf" sshd_binary: "{{ ansible_facts.env.TMPDIR }}/sshd" __sshd_runtime_directory: "{{ ansible_facts.env.TMPDIR }}/run" * tests: Quote also the source filename Signed-off-by: Jakub Jelen <jjelen@redhat.com> * tests: Add more negative test cases Signed-off-by: Jakub Jelen <jjelen@redhat.com> * tests: Skip the test with unsafe TMPDIR as it does not work on CentOS8 Signed-off-by: Jakub Jelen <jjelen@redhat.com> * Move the variable checks to separate file ... ... and explain better why this is problematic Drops also the check for internal variables as the user should not bother with these. Signed-off-by: Jakub Jelen <jjelen@redhat.com> --------- Signed-off-by: Jakub Jelen <jjelen@redhat.com> Co-authored-by: Markus Linnala <Markus.Linnala@knowit.fi>
2024-09-12 08:24:22 +02:00
if test -f {{ item | quote }}; then
mkdir -p {{ __sshd_test_backup.path | quote }}/$(dirname {{ item | quote }})
cp -a {{ item | quote }} {{ __sshd_test_backup.path | quote }}/$(dirname {{ item | quote }})
fi
changed_when: false
loop: "{{ __sshd_test_backup_files | d([]) }}"
when:
- __sshd_test_backup is defined
- __sshd_test_backup.path is defined