blob: a2f22eb46271c08d44cb4133cf8582bf0a69b2d9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
|
# risky-octal
This rule checks that octal file permissions are strings that contain a leading
zero or are written in
[symbolic modes](https://www.gnu.org/software/findutils/manual/html_node/find_html/Symbolic-Modes.html),
such as `u+rwx` or `u=rw,g=r,o=r`.
Using integers or octal values in YAML can result in unexpected behavior. For
example, the YAML loader interprets `0644` as the decimal number `420` but
putting `644` there will produce very different results.
Modules that are checked:
- [`ansible.builtin.assemble`](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/assemble_module.html)
- [`ansible.builtin.copy`](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/copy_module.html)
- [`ansible.builtin.file`](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/file_module.html)
- [`ansible.builtin.replace`](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/replace_module.html)
- [`ansible.builtin.template`](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/template_module.html)
## Problematic Code
```yaml
---
- name: Example playbook
hosts: localhost
tasks:
- name: Unsafe example of declaring Numeric file permissions
ansible.builtin.file:
path: /etc/foo.conf
owner: foo
group: foo
mode: 644
```
## Correct Code
```yaml
---
- name: Example playbook
hosts: localhost
tasks:
- name: Safe example of declaring Numeric file permissions (1st solution)
ansible.builtin.file:
path: /etc/foo.conf
owner: foo
group: foo
mode: "0644" # <- quoting and the leading zero will prevent surprises
# "0o644" is also a valid alternative.
```
|
