如何在查找时进行特权升级（ini）

Question

我的test.yml

      1 - name: Test ini
      2   hosts: localhost
      3   connection: local
      4   become: true
      5 
      6   tasks:
      7 
      8   - name: Verifying /etc/heat/heat.conf Configuration
      9     become_user: root
     10     become_method: sudo
     11     fail: msg="Unable to set in /etc/heat/heat.conf"
     12     when: "lookup('ini', 'max_resources_per_stack section=DEFAULT file=/etc/heat/heat.conf') != '-1'"

错误

$ ansible-playbook test.yml 
 [WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'


PLAY [Test ini] ***********************************************************************************************************************

TASK [Gathering Facts] ****************************************************************************************************************
ok: [localhost]

TASK [Verifying /etc/heat/heat.conf Configuration] ************************************************************************************
fatal: [localhost]: FAILED! => {"msg": "The conditional check 'lookup('ini', 'max_resources_per_stack section=DEFAULT file=/etc/heat/heat.conf') != '-1'' failed. The error was: An unhandled exception occurred while running the lookup plugin 'ini'. Error was a <class 'ansible.errors.AnsibleParserError'>, original message: an error occurred while trying to read the file '/etc/heat/heat.conf': [Errno 13] Permission denied: '/etc/heat/heat.conf'\n\nThe error appears to have been in '/home/stack/test.yml': line 8, column 5, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n  - name: Verifying /etc/heat/heat.conf Configuration\n    ^ here\n"}
    to retry, use: --limit @/home/stack/test.retry

PLAY RECAP ****************************************************************************************************************************
localhost                  : ok=1    changed=0    unreachable=0    failed=1

我不知道为什么它不起作用？ ini 文件修改正在使用 ini_file，而无需指定 become_user 或 become_user。但它不适用于 lookup？即使我也能在 shell 中运行 crudini --get 命令。

$ ls -la /etc/heat/heat.conf 
-rw-r-----. 1 root heat 85196 May 29 01:39 /etc/heat/heat.conf

更新

剧本只有在我运行剧本与 sudo 像 sudo ansible-playbook ini_test.yml

时才有效

更新2

ansible 2.6.11

Answer 1

是bug。

带文件/root/test

> ll /root/test
-rw-r----- 1 root root 30 May 29 15:09 /root/test

剧本

- hosts: localhost
  become_user: root
  become_method: sudo
  become: yes
  tasks:
    - command: whoami
      register: result
    - debug:
        var: result.stdout
    - name: read the file
      debug:
        msg: "{{ lookup('file', '/root/test') }}"

给出（删节）：

ok: [localhost] => {
    "result.stdout": "root"
}
TASK [read the file]
fatal: [localhost]: FAILED! => {"msg": "An unhandled exception occurred while running the lookup plugin 'file'. Error was a <class 'ansible.errors.AnsibleError'>, original message: could not locate file in lookup: /root/test"}

全部启用阅读

> ll /root/test
-rw-r--r-- 1 root root 30 May 29 15:09 /root/test

剧本按预期工作并给出（删节）：

TASK [read the file]
ok: [localhost] => {
    "msg": "Wed May 29 15:09:43 CEST 2019"
}

备案。 How should you answer questions that lead to bug reports?.

如何在查找时进行特权升级（ini）

how to do privilege escalation on lookup(ini)

ansible

ini