Support running custom inventory scripts (only) from within proot if enabled

awx/main/tasks.py

@@ -42,7 +42,8 @@ from awx.main.models import * # Job, JobEvent, ProjectUpdate, InventoryUpdate,
                               # Schedule, UnifiedJobTemplate
 from awx.main.queue import FifoQueue
 from awx.main.utils import (get_ansible_version, decrypt_field, update_scm_url,
-            ignore_inventory_computed_fields, emit_websocket_notification)
+                            ignore_inventory_computed_fields, emit_websocket_notification,
+                            check_proot_installed, build_proot_temp_dir, wrap_args_with_proot)
 
 __all__ = ['RunJob', 'RunSystemJob', 'RunProjectUpdate', 'RunInventoryUpdate',
            'handle_work_error', 'update_inventory_computed_fields']
@@ -315,62 +316,6 @@ class BaseTask(Task):
         '''
         return False
 
-    def check_proot_installed(self):
-        '''
-        Check that proot is installed.
-        '''
-        cmd = [getattr(settings, 'AWX_PROOT_CMD', 'proot'), '--version']
-        try:
-            proc = subprocess.Popen(cmd, stdout=subprocess.PIPE,
-                                    stderr=subprocess.PIPE)
-            result = proc.communicate()
-            return bool(proc.returncode == 0)
-        except (OSError, ValueError):
-            return False
-
-    def build_proot_temp_dir(self, instance, **kwargs):
-        '''
-        Create a temporary directory for proot to use.
-        '''
-        path = tempfile.mkdtemp(prefix='ansible_tower_proot_')
-        os.chmod(path, stat.S_IRUSR|stat.S_IWUSR|stat.S_IXUSR)
-        return path
-
-    def wrap_args_with_proot(self, args, cwd, **kwargs):
-        '''
-        Wrap existing command line with proot to restrict access to:
-         - /etc/tower (to prevent obtaining db info or secret key)
-         - /var/lib/awx (except for current project)
-         - /var/log/tower
-         - /var/log/supervisor
-         - /tmp (except for own tmp files)
-        '''
-        new_args = [getattr(settings, 'AWX_PROOT_CMD', 'proot'), '-r', '/']
-        hide_paths = ['/etc/tower', '/var/lib/awx', '/var/log',
-                      tempfile.gettempdir(), settings.PROJECTS_ROOT,
-                      settings.JOBOUTPUT_ROOT]
-        hide_paths.extend(getattr(settings, 'AWX_PROOT_HIDE_PATHS', None) or [])
-        for path in sorted(set(hide_paths)):
-            if not os.path.exists(path):
-                continue
-            if os.path.isdir(path):
-                new_path = tempfile.mkdtemp(dir=kwargs['proot_temp_dir'])
-                os.chmod(new_path, stat.S_IRUSR|stat.S_IWUSR|stat.S_IXUSR)
-            else:
-                handle, new_path = tempfile.mkstemp(dir=kwargs['proot_temp_dir'])
-                os.close(handle)
-                os.chmod(new_path, stat.S_IRUSR|stat.S_IWUSR)
-            new_args.extend(['-b', '%s:%s' % (new_path, path)])
-        show_paths = [cwd, kwargs['private_data_dir']]
-        show_paths.extend(getattr(settings, 'AWX_PROOT_SHOW_PATHS', None) or [])
-        for path in sorted(set(show_paths)):
-            if not os.path.exists(path):
-                continue
-            new_args.extend(['-b', '%s:%s' % (path, path)])
-        new_args.extend(['-w', cwd])
-        new_args.extend(args)
-        return new_args
-
     def build_args(self, instance, **kwargs):
         raise NotImplementedError
 
@@ -483,11 +428,11 @@ class BaseTask(Task):
             stdout_filename = os.path.join(settings.JOBOUTPUT_ROOT, str(uuid.uuid1()) + ".out")
             stdout_handle = codecs.open(stdout_filename, 'w', encoding='utf-8')
             if self.should_use_proot(instance, **kwargs):
-                if not self.check_proot_installed():
+                if not check_proot_installed():
                     raise RuntimeError('proot is not installed')
-                kwargs['proot_temp_dir'] = self.build_proot_temp_dir(instance, **kwargs)
-                args = self.wrap_args_with_proot(args, cwd, **kwargs)
-                safe_args = self.wrap_args_with_proot(safe_args, cwd, **kwargs)
+                kwargs['proot_temp_dir'] = build_proot_temp_dir()
+                args = wrap_args_with_proot(args, cwd, **kwargs)
+                safe_args = wrap_args_with_proot(safe_args, cwd, **kwargs)
             instance = self.update_model(pk, job_args=json.dumps(safe_args),
                                          job_cwd=cwd, job_env=safe_env, result_stdout_file=stdout_filename)
             status = self.run_pexpect(instance, args, cwd, env, kwargs['passwords'], stdout_handle)
@@ -1140,6 +1085,7 @@ class RunInventoryUpdate(BaseTask):
             f.close()
             os.chmod(path, stat.S_IRUSR|stat.S_IWUSR|stat.S_IXUSR)
             args.append(runpath)
+            args.append("--custom")
             # try:
             #     shutil.rmtree(runpath, True)
             # except OSError: