summaryrefslogtreecommitdiffstats
path: root/src/ansiblelint/rules/risky_octal.md
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-13 12:06:49 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-13 12:06:49 +0000
commit2fe34b6444502079dc0b84365ce82dbc92de308e (patch)
tree8fedcab52bbbc3db6c5aa909a88a7a7b81685018 /src/ansiblelint/rules/risky_octal.md
parentInitial commit. (diff)
downloadansible-lint-2fe34b6444502079dc0b84365ce82dbc92de308e.tar.xz
ansible-lint-2fe34b6444502079dc0b84365ce82dbc92de308e.zip
Adding upstream version 6.17.2.upstream/6.17.2
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'src/ansiblelint/rules/risky_octal.md')
-rw-r--r--src/ansiblelint/rules/risky_octal.md49
1 files changed, 49 insertions, 0 deletions
diff --git a/src/ansiblelint/rules/risky_octal.md b/src/ansiblelint/rules/risky_octal.md
new file mode 100644
index 0000000..a2f22eb
--- /dev/null
+++ b/src/ansiblelint/rules/risky_octal.md
@@ -0,0 +1,49 @@
+# risky-octal
+
+This rule checks that octal file permissions are strings that contain a leading
+zero or are written in
+[symbolic modes](https://www.gnu.org/software/findutils/manual/html_node/find_html/Symbolic-Modes.html),
+such as `u+rwx` or `u=rw,g=r,o=r`.
+
+Using integers or octal values in YAML can result in unexpected behavior. For
+example, the YAML loader interprets `0644` as the decimal number `420` but
+putting `644` there will produce very different results.
+
+Modules that are checked:
+
+- [`ansible.builtin.assemble`](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/assemble_module.html)
+- [`ansible.builtin.copy`](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/copy_module.html)
+- [`ansible.builtin.file`](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/file_module.html)
+- [`ansible.builtin.replace`](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/replace_module.html)
+- [`ansible.builtin.template`](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/template_module.html)
+
+## Problematic Code
+
+```yaml
+---
+- name: Example playbook
+ hosts: localhost
+ tasks:
+ - name: Unsafe example of declaring Numeric file permissions
+ ansible.builtin.file:
+ path: /etc/foo.conf
+ owner: foo
+ group: foo
+ mode: 644
+```
+
+## Correct Code
+
+```yaml
+---
+- name: Example playbook
+ hosts: localhost
+ tasks:
+ - name: Safe example of declaring Numeric file permissions (1st solution)
+ ansible.builtin.file:
+ path: /etc/foo.conf
+ owner: foo
+ group: foo
+ mode: "0644" # <- quoting and the leading zero will prevent surprises
+ # "0o644" is also a valid alternative.
+```