Skip to content

Conversation

Klaas-
Copy link
Contributor

@Klaas- Klaas- commented May 16, 2025

SUMMARY

As of right now the authorized_key module does not notice on an "absent" if a authorized_keys file is simply not readable to the executing user. I am trying to fix that

ISSUE TYPE
  • Bugfix Pull Request
COMPONENT NAME

authorized_key

ADDITIONAL INFORMATION

Execute as a user that does not have access to the root users authorized keys file

- name: Delete key from root user
  ansible.posix.authorized_key:
    state: absent
    user: root
    key: ssh-rsa xxxxxxxx

- name: Delete key from root user
  become: true
  ansible.posix.authorized_key:
    state: absent
    user: root
    key: ssh-rsa xxxxxxxx

The one without become will succeed before my change and will fail with a permission denied error after my change. The 2nd task will actually remove a key from root user if become privileges are available for the executing user

Copy link
Contributor

@Klaas- Klaas- force-pushed the Klaas-fix_authorized_key branch from 50988a0 to 67345a4 Compare May 16, 2025 15:13
@Klaas-
Copy link
Contributor Author

Klaas- commented May 16, 2025

I think I fixed all the problems related to my code -- I hope I made it 2.7 compatible :)

The last failure is

00:08 + ansible-test integration --color -v --retry-on-error shippable/posix/group1/ --coverage-check --changed --allow-unstable-changed --remote freebsd/13.2 --remote-terminate always --remote-stage prod --remote-provider default
00:09 Detected CI provider: Azure Pipelines
00:09 FATAL: Environment `--remote freebsd/13.2` is unknown. Use a predefined environment instead. Alternatively, to use an unknown environment, use the `--python` option to specify a Python version

there seems to be a general problem there

same for the other freebsd job

Copy link
Contributor

@Klaas- Klaas- force-pushed the Klaas-fix_authorized_key branch from 67345a4 to 53ad4fb Compare May 17, 2025 06:05
Copy link
Contributor

@Klaas-
Copy link
Contributor Author

Klaas- commented May 17, 2025

Also added a changelog fragement

@Klaas- Klaas- force-pushed the Klaas-fix_authorized_key branch from 53ad4fb to 889ca91 Compare May 20, 2025 10:36
Copy link
Contributor

@Klaas-
Copy link
Contributor Author

Klaas- commented May 20, 2025

I rebased it on the fixed CI from #640 - I think it's good to merge @saito-hideki

@Klaas-
Copy link
Contributor Author

Klaas- commented Jul 23, 2025

any chance to get this on the road @saito-hideki ? anything I can do to help the process?

@Klaas- Klaas- force-pushed the Klaas-fix_authorized_key branch from 889ca91 to 3d61341 Compare October 20, 2025 15:13
Copy link
Contributor

@Klaas- Klaas- force-pushed the Klaas-fix_authorized_key branch from 3d61341 to 6b9fd0a Compare October 20, 2025 18:22
@bcoca
Copy link
Collaborator

bcoca commented Oct 20, 2025

An integration test would be nice

Copy link
Contributor

@Klaas- Klaas- force-pushed the Klaas-fix_authorized_key branch from 6b9fd0a to 624c151 Compare October 20, 2025 19:52
Copy link
Contributor

@Klaas-
Copy link
Contributor Author

Klaas- commented Oct 20, 2025

An integration test would be nice

the tests are run as root it seems, to there is no permission denied happening :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants