External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-03-07 19:51:08 -03:30
Code Issues Packages Projects Releases Wiki Activity

bind ansible and awx virtualenvs readonly so that jobs can't modify them

Browse Source 
see: https://github.com/ansible/ansible-tower/issues/7558
This commit is contained in:
Ryan Petrello
2017-09-06 14:12:47 -07:00
parent a2ca0e6012
commit a9c9ecb5ea
2 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
awx/main/tests/unit/test_tasks.py
View File

@@ -281,6 +281,15 @@ class TestGenericRun(TestJobExecution):
args, cwd, env, stdout = call_args args, cwd, env, stdout = call_args
assert args[0] == 'bwrap' assert args[0] == 'bwrap'
def test_bwrap_virtualenvs_are_readonly(self):
self.task.run(self.pk)
assert self.run_pexpect.call_count == 1
call_args, _ = self.run_pexpect.call_args_list[0]
args, cwd, env, stdout = call_args
assert '--ro-bind %s %s' % (settings.ANSIBLE_VENV_PATH, settings.ANSIBLE_VENV_PATH) in ' '.join(args) # noqa
assert '--ro-bind %s %s' % (settings.AWX_VENV_PATH, settings.AWX_VENV_PATH) in ' '.join(args) # noqa
def test_awx_task_env(self): def test_awx_task_env(self):
patch = mock.patch('awx.main.tasks.settings.AWX_TASK_ENV', {'FOO': 'BAR'}) patch = mock.patch('awx.main.tasks.settings.AWX_TASK_ENV', {'FOO': 'BAR'})
patch.start() patch.start()

6
awx/main/utils/common.py
View File

@@ -699,7 +699,11 @@ def wrap_args_with_proot(args, cwd, **kwargs):
show_paths = [cwd, kwargs['private_data_dir']] show_paths = [cwd, kwargs['private_data_dir']]
else: else:
show_paths = [cwd] show_paths = [cwd]
show_paths.extend([settings.ANSIBLE_VENV_PATH, settings.AWX_VENV_PATH]) for venv in (
settings.ANSIBLE_VENV_PATH,
settings.AWX_VENV_PATH
):
new_args.extend(['--ro-bind', venv, venv])
show_paths.extend(getattr(settings, 'AWX_PROOT_SHOW_PATHS', None) or []) show_paths.extend(getattr(settings, 'AWX_PROOT_SHOW_PATHS', None) or [])
show_paths.extend(kwargs.get('proot_show_paths', [])) show_paths.extend(kwargs.get('proot_show_paths', []))
for path in sorted(set(show_paths)): for path in sorted(set(show_paths)):