The default permissions used by atomic_move can create files that are world readable #67794

samdoran · 2020-02-26T19:54:05Z

SUMMARY

CVE-2020-1736

If a file doesn't exist, we create it with 0666 permissions combined with the current umask. Depending on the default umask as well as the permissions on the destination directory, this could result in world readable files.

Relevant code:
Default permissions:

ansible/lib/ansible/module_utils/common/file.py

Lines 60 to 62 in 79dfae9

    
           _PERM_BITS = 0o7777          # file mode permission bits 
        
           _EXEC_PERM_BITS = 0o0111     # execute permission bits 
        
           _DEFAULT_PERM = 0o0666       # default file permission bits

creation in atomic_move:

ansible/lib/ansible/module_utils/basic.py

Lines 2296 to 2303 in 79dfae9

    
           if creating: 
        
               # make sure the file has the correct permissions 
        
               # based on the current value of umask 
        
               umask = os.umask(0) 
        
               os.umask(umask) 
        
               os.chmod(b_dest, DEFAULT_PERM & ~umask) 
        
               try: 
        
                   os.chown(b_dest, os.geteuid(), os.getegid())

if creating:
    # make sure the file has the correct permissions
    # based on the current value of umask
    umask = os.umask(0)
    os.umask(umask)
    os.chmod(b_dest, DEFAULT_PERM & ~umask)
    try:
        os.chown(b_dest, os.geteuid(), os.getegid())
    except OSError:
        # We're okay with trying our best here.  If the user is not
        # root (or old Unices) they won't be able to chown.
        pass

Suggested correction is to use more restrictive permissions by default and/or add a mechanism to prevent creating world readable files.

ISSUE TYPE

Bug Report

COMPONENT NAME

ansible/lib/ansible/module_utils/common/file.py
ansible/lib/ansible/module_utils/basic.py

ANSIBLE VERSION

2.10

CONFIGURATION

default

OS / ENVIRONMENT

STEPS TO REPRODUCE

EXPECTED RESULTS

ACTUAL RESULTS

The text was updated successfully, but these errors were encountered:

ansibot · 2020-02-26T19:55:42Z

Files identified in the description:
None

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

ansibot · 2020-02-26T20:07:13Z

Files identified in the description:

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

bcoca · 2020-04-02T15:16:27Z

https://github.com/ansible/ansible-stage/pull/34

fixes ansible#67794 updated some tests that expected previous defaults CVE-2020-1736

fixes #67794 updated some tests that expected previous defaults CVE-2020-1736

…8970) fixes ansible#67794 updated some tests that expected previous defaults CVE-2020-1736 (cherry picked from commit 566f246)

bcoca · 2020-04-16T16:53:22Z

reopened since PR that had been merged was reverted due to much larger impact than initially forseen.

brianmay · 2020-05-06T22:07:36Z

@bcoca Can you please point me to the commit were this was reverted? I am not seeing it. https://github.com/bcoca/ansible/commits/2127777856f81bd03666db5a68b379901a849845/lib/ansible/module_utils/common/file.py

bcoca · 2020-05-07T03:31:17Z

5733660

brianmay · 2020-05-07T21:26:47Z

OK, so according to #68983 it appears this was reverted because we broke some tests in collections. What is the solution? Maybe we need a DEFAULT_UMASK setting or something. initially this could be 666, over time we could work to move this to 660.

As of Ansible 2.9.12, the default modes are stricter. See: ansible/ansible#67794

eoli3n · 2020-08-19T06:55:48Z

It broke my playbook too.

Ansible should do the expected thing of deferring to the system umask or mode in the module for permissions on the final file.

Yes it should.

As of Ansible 2.9.12, the default modes are stricter. See: ansible/ansible#67794

HontoNoRoger · 2020-08-20T14:12:31Z

I also ran into this issue today, using Ansible 2.9.12 from the Launchpad Ansible repo:
http://ppa.launchpad.net/ansible/ansible/ubuntu bionic/main amd64 Packages

Could it be that is hasn't been reverted there? It is causing a lot of trouble for our automated installations currently.

relrod · 2020-08-20T14:23:05Z

Correct, there has not yet been another release since the change was reverted. The revert will be in the next 2.9 release.

n-cc · 2020-08-20T14:54:45Z

Is there a timeline for a new release? I'm specifically interested in 2.8, but it'd probably be helpful to know both.

relrod · 2020-08-20T16:59:40Z

Likely around 8/31 or 9/1. Releases typically happen every 3 weeks (though that is changing slightly, soon).

We need to set mode for copy operation otherwise ansible-2.9.12 can lead to too restrictive default permissions[1]. Setting mode for copy operations handles the warning. [1.] ansible/ansible#67794 Change-Id: Ieae36a1d85a7da84ee2cd982a20dcabe9e65511f Signed-off-by: Chandan Kumar (raukadah) <chkumar@redhat.com>

* Update openstack-ansible-os_tempest from branch 'master' - Set mode for copy operation We need to set mode for copy operation otherwise ansible-2.9.12 can lead to too restrictive default permissions[1]. Setting mode for copy operations handles the warning. [1.] ansible/ansible#67794 Change-Id: Ieae36a1d85a7da84ee2cd982a20dcabe9e65511f Signed-off-by: Chandan Kumar (raukadah) <chkumar@redhat.com>

v2.9.12 ======= Minor Changes ------------- - ansible-test - the ACME test container was updated, it now supports external account creation and has a basic OCSP responder (ansible/ansible#71097, https://github.com/ansible/acme-test-container/releases/tag/2.0.0). - debconf - add a note about no_log=True since module might expose sensitive information to logs (ansible/ansible#32386). Security Fixes -------------- - **security issue** - copy - Redact the value of the no_log 'content' parameter in the result's invocation.module_args in check mode. Previously when used with check mode and with '-vvv', the module would not censor the content if a change would be made to the destination path. (CVE-2020-14332) - **security issue** atomic_move - change default permissions when creating temporary files so they are not world readable (ansible/ansible#67794) (CVE-2020-1736) - Fix warning for default permission change when no mode is specified. Follow up to ansible/ansible#67794. (CVE-2020-1736) - Sanitize no_log values from any response keys that might be returned from the uri module (CVE-2020-14330). - reset logging level to INFO due to CVE-2019-14846. Bugfixes -------- - Address compat with rpmfluff-0.6 for integration tests - Ensure password passed in by -k is used on delegated hosts that do not have ansible_password set - Template connection variables before using them (ansible/ansible#70598). - Terminal plugins - add "\e[m" to the list of ANSI sequences stripped from device output - add magic/connection vars updates from delegated host info. - ansible-galaxy collection install - fix fallback mechanism if the AH server did not have the collection requested - ansible/ansible#70940 - ansible-test - Add ``pytest < 6.0.0`` constraint for managed installations on Python 3.x to avoid issues with relative imports. - ansible-test - Change detection now properly resolves relative imports instead of treating them as absolute imports. - api - time.clock is removed in Python 3.8, add backward compatible code (ansible/ansible#70649). - avoid clobbering existing facts inside loop when task also returns ansible_facts. - basic - use PollSelector implementation when DefaultSelector fails (ansible/ansible#70238). - cron - encode and decode crontab files in UTF-8 explicitly to allow non-ascii chars in cron filepath and job (ansible/ansible#69492) - ensure delegated vars can resolve hostvars object and access vars from hostvars[inventory_hostname]. - facts - account for Slackware OS with ``+`` in the name (ansible/ansible#38760) - facts - fix incorrect UTC timestamp in ``iso8601_micro`` and ``iso8601`` - fix issue with inventory_hostname and delegated host vars mixing on connection settings. - hashi_vault - Handle equal sign in key=value (ansible/ansible#55658). - ipa_hostgroup - fix an issue with load-balanced ipa and cookie handling with Python 3 - (ansible/ansible#71110). - lineinfile - fix not subscriptable error in exception handling around file creation - linux network facts - get the correct value for broadcast address (ansible/ansible#64384) - mysql_user - fix overriding password to the same (ansible-collections/community.general#543). - net_put - Fixed UnboundLocalError when there is no change This is a backport from U(ansible-collections/ansible.netcommon#6) - nxos_user - do not fail when a custom role is used (ansible-collections/cisco.nxos#130) - ovirt_vm - fix cd_iso search - playbooks - detect and propagate failures in ``always`` blocks after ``rescue`` (ansible/ansible#70000) - profile_tasks - typecast result before slicing it (ansible/ansible#59059). - reboot - Add support for the runit init system, used on Void Linux, that does not support the normal Linux syntax. - redfish_info, redfish_config, redfish_command - Fix Redfish response payload decode on Python 3.5 (ansible/ansible#65889) - shell - fix quoting of mkdir command in creation of remote_tmp in order to allow spaces and other special characters (ansible/ansible#69577). - templating - fix error message for ``x in y`` when y is undefined (ansible/ansible#70984) - unarchive - check ``fut_gid`` against ``run_gid`` in addition to supplemental groups (ansible/ansible#49284) - user - don't create home directory and missing parents when create_home == false (ansible/ansible#70600). - yum - fix yum list crashing if repoquery (used internally) prints errors in stdout (ansible/ansible#56800)

Add a comment to parameter 'mode' to highlight CVE-2020-1736 and the versions of Ansible that are vulnerable. As of Ansible 2.9.10, this vulnerability has not been properly addressed so that string '2.9.10' is subject to a future change. Tickets: - Refs ansible#67794 - Refs ansible#71324

ansibot · 2021-02-16T22:56:13Z

Files identified in the description:

If these files are incorrect, please update the component name section of the description or use the !component bot command.

click here for bot help

ansibot · 2021-02-24T23:13:18Z

Files identified in the description:

If these files are incorrect, please update the component name section of the description or use the !component bot command.

click here for bot help

mvorisek · 2021-12-07T13:04:48Z

I wonder is there any Ansible config where I can simply set the default file/dir mode or umask to 0644? Or is 0644 always the default?

leegarrett · 2021-12-07T16:00:18Z

I wonder is there any Ansible config where I can simply set the default file/dir mode or umask to 0644? Or is 0644 always the default?

Read the bug report. The current umask is whatever the target system has set as default, which for Debian-based systems is 0022. You don't want to set it to 0644. IMHO this isn't a security bug, because you have to deliberately set the umask to make files world-readable ... to get world-readable files.

mvorisek · 2021-12-07T16:30:39Z

I meant if the 0022 umask can be enforced as a default by ansible configuration.

leegarrett · 2021-12-07T16:40:48Z

I meant if the 0022 umask can be enforced as a default by ansible configuration.

Please ask in a support channel as this is unrelated to the bug report.

bcoca · 2022-07-20T15:09:17Z

closing this as it is not really an ansible bug, but how the user has configured umask on their system.

samdoran added the security Related to a vulnerability or CVE label Feb 26, 2020

ansibot added affects_2.10 This issue/PR affects Ansible v2.10 bug This issue/PR relates to a bug. support:core This issue/PR relates to code supported by the Ansible Engineering Team. labels Feb 26, 2020

ansibot added the has_pr This issue has an associated PR. label Apr 2, 2020

bcoca self-assigned this Apr 3, 2020

bcoca added a commit to bcoca/ansible that referenced this issue Apr 16, 2020

stricter permissions on atomic_move when creating new file

1205650

fixes ansible#67794 updated some tests that expected previous defaults CVE-2020-1736

bcoca mentioned this issue Apr 16, 2020

stricter permissions on atomic_move when creating new file #68970

Merged

bcoca added a commit to bcoca/ansible that referenced this issue Apr 16, 2020

stricter permissions on atomic_move when creating new file

a2ef19e

fixes ansible#67794 updated some tests that expected previous defaults CVE-2020-1736

bcoca closed this as completed in #68970 Apr 16, 2020

bcoca added a commit that referenced this issue Apr 16, 2020

stricter permissions on atomic_move when creating new file (#68970)

566f246

fixes #67794 updated some tests that expected previous defaults CVE-2020-1736

bcoca added a commit to bcoca/ansible that referenced this issue Apr 16, 2020

stricter permissions on atomic_move when creating new file (ansible#6…

2127777

…8970) fixes ansible#67794 updated some tests that expected previous defaults CVE-2020-1736 (cherry picked from commit 566f246)

bcoca added a commit to bcoca/ansible that referenced this issue Apr 16, 2020

stricter permissions on atomic_move when creating new file (ansible#6…

43fa2d1

…8970) fixes ansible#67794 updated some tests that expected previous defaults CVE-2020-1736 (cherry picked from commit 566f246)

This was referenced Apr 16, 2020

stricter permissions on atomic_move when creating new file (#68970) #68976

Closed

stricter permissions on atomic_move when creating new file (#68970) #68977

Closed

bcoca reopened this Apr 16, 2020

mweinelt mentioned this issue May 5, 2020

ansible: v2.9.2 → v2.9.7, v2.8.7 → v2.8.11, v2.7.15 → v2.7.17 NixOS/nixpkgs#86980

Merged

10 tasks

ansibot added the needs_triage Needs a first human triage before being processed. label May 17, 2020

jimi-c removed the needs_triage Needs a first human triage before being processed. label May 19, 2020

jimi-c mentioned this issue May 29, 2020

copy module creates destination file initially with umask of connection context rather than secure or specified mode #46971

Closed

samdoran assigned samdoran and unassigned bcoca Jun 18, 2020

samdoran mentioned this issue Jun 22, 2020

Change default file permissions so they are not world readable #70221

Merged

3 tasks

nre-ableton added a commit to Ableton/ansible-role-jenkins-jcasc that referenced this issue Aug 18, 2020

Add modes for file-related modules

b61985b

As of Ansible 2.9.12, the default modes are stricter. See: ansible/ansible#67794

yaobinwen-mvs mentioned this issue Aug 19, 2020

Missing 'mode' on file copy can lead to too restrictive default permissions geerlingguy/ansible-for-devops#314

Closed

ghost pushed a commit to Ableton/ansible-role-jenkins-jcasc that referenced this issue Aug 19, 2020

Add modes for file-related modules

94913a2

As of Ansible 2.9.12, the default modes are stricter. See: ansible/ansible#67794

nre-ableton added a commit to Ableton/ansible-role-jenkins-jcasc that referenced this issue Aug 19, 2020

Add modes for file-related modules

a692471

As of Ansible 2.9.12, the default modes are stricter. See: ansible/ansible#67794

TuxInvader mentioned this issue Aug 21, 2020

Set file permissions on APT configuration files and keys nginxinc/ansible-role-nginx#308

Closed

mamedin mentioned this issue Aug 28, 2020

CentOS deploy with ansible >=2.9.12 fails (permissions issue) archivematica/Issues#1297

Open

5 tasks

OldCrowEW mentioned this issue Aug 28, 2020

correct linting 208 issues OldCrowEW/ansible-role-hashicorp-consul#16

Merged

jahsome mentioned this issue Sep 1, 2020

File '...REVISION' created with default permissions '600' warning ansistrano/deploy#361

Closed

samy-mahmoudi mentioned this issue Oct 7, 2020

docs: Mention CVE-2020-1736 in the documentation #72127

Closed

samdoran removed their assignment Jul 13, 2021

bcoca closed this as completed Jul 20, 2022

ansible locked and limited conversation to collaborators Jul 27, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

The default permissions used by atomic_move can create files that are world readable #67794

The default permissions used by atomic_move can create files that are world readable #67794

samdoran commented Feb 26, 2020 •

edited

Loading

ansibot commented Feb 26, 2020

ansibot commented Feb 26, 2020

bcoca commented Apr 2, 2020

bcoca commented Apr 16, 2020

brianmay commented May 6, 2020

bcoca commented May 7, 2020

brianmay commented May 7, 2020

eoli3n commented Aug 19, 2020 •

edited

Loading

HontoNoRoger commented Aug 20, 2020

relrod commented Aug 20, 2020

n-cc commented Aug 20, 2020

relrod commented Aug 20, 2020

ansibot commented Feb 16, 2021

ansibot commented Feb 24, 2021

mvorisek commented Dec 7, 2021

leegarrett commented Dec 7, 2021

mvorisek commented Dec 7, 2021

leegarrett commented Dec 7, 2021

bcoca commented Jul 20, 2022

The default permissions used by atomic_move can create files that are world readable #67794

The default permissions used by atomic_move can create files that are world readable #67794

Comments

samdoran commented Feb 26, 2020 • edited Loading

SUMMARY

ISSUE TYPE

COMPONENT NAME

ANSIBLE VERSION

CONFIGURATION

OS / ENVIRONMENT

STEPS TO REPRODUCE

EXPECTED RESULTS

ACTUAL RESULTS

ansibot commented Feb 26, 2020

ansibot commented Feb 26, 2020

bcoca commented Apr 2, 2020

bcoca commented Apr 16, 2020

brianmay commented May 6, 2020

bcoca commented May 7, 2020

brianmay commented May 7, 2020

eoli3n commented Aug 19, 2020 • edited Loading

HontoNoRoger commented Aug 20, 2020

relrod commented Aug 20, 2020

n-cc commented Aug 20, 2020

relrod commented Aug 20, 2020

ansibot commented Feb 16, 2021

ansibot commented Feb 24, 2021

mvorisek commented Dec 7, 2021

leegarrett commented Dec 7, 2021

mvorisek commented Dec 7, 2021

leegarrett commented Dec 7, 2021

bcoca commented Jul 20, 2022

samdoran commented Feb 26, 2020 •

edited

Loading

eoli3n commented Aug 19, 2020 •

edited

Loading