Invoke vault password scripts via original path specified

[jmehnle]

ISSUE TYPE

• Bug Report

COMPONENT NAME

--vault-password-file

ANSIBLE VERSION

ansible 1.9.3

(but also occurs in Ansible 2)

DESCRIPTION

When specifying an executable vault password file, Ansible invokes it by its "real" path, not by the path as specified. This matters if what's passed is actually a symlink to an executable, and the executable uses the path by which it is invoked to determine the password to produce.

For example:

$ ls -l
total 16
-rwxr-xr-x  1 julian  staff  290 Nov  2 23:03 get-password
-rw-------  1 julian  staff  355 Nov  2 23:10 secrets.yml

secrets.yml is a dummy variables vault file created by ansible-vault create with the password foo-bar-ansible.

$ cat get-password
#!/bin/sh

basename="$(basename $0)"
basename_prefix="get-password"
default_password="foo-bar"

case "${basename}" in
  "${basename_prefix}"-*)
    password="${default_password}-${basename#${basename_prefix}-}"
    ;;
  *)
    password="${default_password}"
    ;;
esac

echo "${password}"

This script produces the password foo-bar if invoked directly, but produces a different password when invoked through a symlink that begins with get-password-, e.g., foo-bar-quux when invoked as get-password-quux. This script is a synthetic example, but I actually use this mechanism with a more complicated password retrieval script that installs various symlinks for different applications, Ansible being one of them.

Now lets create a symlink with a suitable name:

$ ln -s get-password get-password-ansible
$ ls -l get-password*
-rwxr-xr-x  1 julian  staff  290 Nov  2 23:03 get-password
lrwxr-xr-x  1 julian  staff   12 Nov  2 23:24 get-password-ansible -> get-password
$ ./get-password
foo-bar
$ ./get-password-ansible
foo-bar-ansible
$ ansible all -i localhost, -c local -a uptime -e @secrets.yml --vault-password-file get-password-ansible
ERROR: Decryption failed

Oops. We're invoking get-password-ansible, which as we just saw, produces the correct password, foo-bar-ansible. What gives?

Well, now let's try replacing the symlink with a straight-up copy of the real file:

$ rm -f get-password-ansible
$ cp get-password get-password-ansible
$ ls -l get-password*
-rwxr-xr-x  1 julian  staff  290 Nov  2 23:03 get-password
-rwxr-xr-x  1 julian  staff  290 Nov  2 23:12 get-password-ansible
$ ./get-password
foo-bar
$ ./get-password-ansible
foo-bar-ansible
$ ansible all -i localhost, -c local -a uptime -e @secrets.yml --vault-password-file get-password-ansible
localhost | success | rc=0 >>
23:12  up 29 days,  2:46, 24 users, load averages: 1.22 1.50 1.58

Oh, hey, this time it worked!

And this is consistent with how the real_vault_password_file function is defined in https://github.com/ansible/ansible/blob/devel/lib/ansible/cli/__init__.py#L613. It calls os.path.realpath() on the file name provided and then invokes the script by that name.

It would be more useful if the vault password file's executability was determined by its real path, etc., but then invoked by its original path.

[calfonso]

@jmehnle Would you mind rebasing and testing, we believe this has been fixed.

[jmehnle]

@calfonso, how would this have been fixed? It seems the code still suffers from the same confusion of what my patch calls the "full path" with the "real path". Unless you separate the two out, I don't believe the problem can be fixed.

[ansibot]

@jmehnle this PR contains the following merge comits:

• 1593224

Please rebase your branch to remove these commits.

click here for bot help

[mattclay]

Rebase needed.

[jmehnle]

I just rebased it the other day. What gives??

[ansibot]

@jmehnle this PR contains the following merge comits:

• fc8add9

Please rebase your branch to remove these commits.

click here for bot help

[mattclay]

@jmehnle The latest rebase was needed because the file changed by this PR had been modified by other PR(s) which were already merged, causing conflicts with your changes.

[sivel]

This issue still exists, but the code has change quite a lot.

I think this would be a good change, as I understand the reasons behind it.

The new code is located at:

ansible/lib/ansible/parsing/vault/__init__.py

Lines 372 to 373 in 9773a1f

	def get_file_vault_secret(filename=None, vault_id=None, encoding=None, loader=None):
	this_path = os.path.realpath(os.path.expanduser(filename))

I think we just need to change realpath to abspath there.

[bcoca]

@jmehnle can you confirm that PR above resolves your issue?