Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ansible reads group_vars from cwd with precedence #16953

Closed
kustodian opened this issue Aug 4, 2016 · 6 comments
Closed

Ansible reads group_vars from cwd with precedence #16953

kustodian opened this issue Aug 4, 2016 · 6 comments
Assignees
@jimi-c @bcoca
Labels
bug This issue/PR relates to a bug.

Comments

@kustodian
Copy link
Contributor

ISSUE TYPE
  • Bug Report
ANSIBLE VERSION
ansible 2.1.1.0
CONFIGURATION

N/A

OS / ENVIRONMENT

Ubuntu/CentOS

SUMMARY

If the inventory and the playbook are not in the current working directory (cwd), and group_vars exists in cwd, Ansible will read variables from cwd/group_vars and will even give them precedence. This only happens if the same file exists in both group_vars of cwd and the inventory. The

STEPS TO REPRODUCE

Here is a simple repro. Create a file structure like this:

├── group_vars
│   └── g1
├── inventories
│   └── test
│       ├── group_vars
│       │   └── g1
│       └── hosts
└── playbooks
    └── site.yml

# group_vars/g1

---
var1: "Set in CWD"
# inventories/test/hosts
[g1]
localhost
# inventories/test/group_vars/g1

---
var1: "Set in inventory"
# playbooks/site.yml

---
- hosts: localhost
  gather_facts: no
  connection: local
  tasks:
    - debug: var=var1

Run site.yml with this inventory:

ansible-playbook -i inventories/test/hosts playbooks/site.yml
EXPECTED RESULTS

It should display var1: "Set in inventory".

ACTUAL RESULTS

It actually displays the value of the variable defined in cwd:

TASK [debug] *******************************************************************
ok: [localhost] => {
    "var1": "Set in CWD"
}
@kustodian kustodian changed the title Ansible reads group_vars from cwd Ansible reads group_vars from cwd with precedence Aug 4, 2016
@jinnko
Copy link

jinnko commented Aug 6, 2016

I believe this is a similar issue to #16956

@kustodian
Copy link
Contributor Author

Any news about when will this issue big fixed, since this is a security concern. Variables which Ansible reads from the current working directory can bet set that way to make the managed host(s) unusable.

jimi-c added a commit that referenced this issue Aug 17, 2016
@jimi-c
Don't use an unset playbook basedir when searching for hostgroup vars
19c4af3 
The flag new_pb_basedir is not being utilized in Inventory._get_hostgroup_vars,
leading to the situation where an inventory with no playbook basedir set will
read host/group vars from the $CWD, regardless of the inventory and/or playbook
relative location. This patch corrects that by not using the playbook basedir
if it is unset (None).

This patch also corrects a bug in which the VariableManager would accumulate
host/group vars files, which could lead to incorrect vars files being used when
playbooks are run from different directories containing their own group/host vars
directories.

Fixes #16953
jimi-c added a commit that referenced this issue Aug 17, 2016
@jimi-c
Don't use an unset playbook basedir when searching for hostgroup vars
ea7a038 
The flag new_pb_basedir is not being utilized in Inventory._get_hostgroup_vars,
leading to the situation where an inventory with no playbook basedir set will
read host/group vars from the $CWD, regardless of the inventory and/or playbook
relative location. This patch corrects that by not using the playbook basedir
if it is unset (None).

This patch also corrects a bug in which the VariableManager would accumulate
host/group vars files, which could lead to incorrect vars files being used when
playbooks are run from different directories containing their own group/host vars
directories.

Fixes #16953

(cherry picked from commit b617d62)
@jimi-c jimi-c closed this as completed in b617d62 Aug 17, 2016
@jimi-c
Copy link
Member

jimi-c commented Aug 17, 2016

Closing This Ticket

Hi!

We believe the above commit should resolve this problem for you. This will also be included in the next release.

If you continue seeing any problems related to this issue, or if you have any further questions, please let us know by stopping by one of the two mailing lists, as appropriate:

Because this project is very active, we're unlikely to see comments made on closed tickets, but the mailing list is a great way to ask questions, or post if you don't think this particular issue is resolved.

Thank you!

@kustodian kustodian mentioned this issue Aug 18, 2016
Closed
@GoodHaHa
Copy link

Hill,kustodian
I have the same problem. At present, Which version to solve this problem?

@nohi nohi mentioned this issue Oct 19, 2016
Closed
@kustodian
Copy link
Contributor Author

@GoodHaHa 2.1.2 should fix the issue.

@GoodHaHa
Copy link

@kustodian Thinks very much.

sereinity pushed a commit to sereinity-forks/ansible that referenced this issue Jan 25, 2017
@jimi-c
Don't use an unset playbook basedir when searching for hostgroup vars
3c74b4b 
The flag new_pb_basedir is not being utilized in Inventory._get_hostgroup_vars,
leading to the situation where an inventory with no playbook basedir set will
read host/group vars from the $CWD, regardless of the inventory and/or playbook
relative location. This patch corrects that by not using the playbook basedir
if it is unset (None).

This patch also corrects a bug in which the VariableManager would accumulate
host/group vars files, which could lead to incorrect vars files being used when
playbooks are run from different directories containing their own group/host vars
directories.

Fixes ansible#16953
@ansibot ansibot added bug This issue/PR relates to a bug. and removed bug_report labels Mar 7, 2018
@ansible ansible locked and limited conversation to collaborators Apr 25, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@jimi-c jimi-c

@bcoca bcoca

Labels
bug This issue/PR relates to a bug.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@jimi-c @jinnko @bcoca @kustodian @ansibot @GoodHaHa