Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rhsm modules: cleanly fail when not run as root #6211

Conversation

ptoscano
Copy link
Contributor

SUMMARY

subscription-manager on RHEL installs a symlink in /usr/bin to console-helper (part of usermode), which triggers an interactive prompt for root credentials when run as user. It seems that console-helper does not handle well non-interactive contexts (e.g. without a TTY for input), and thus it will hang waiting for input when run as user in an Ansible task.

Since subscription-manager requires root already anyway (and it will fail when explicitly run as user), then apply the same logic locally on all the modules that interact with it: redhat_subscription, rhsm_release, and rhsm_repository.

Fixes #734

ISSUE TYPE
  • Bugfix Pull Request
COMPONENT NAME

redhat_subscription

ADDITIONAL INFORMATION

A simple reproducer is running any of redhat_subscription, rhsm_release, or rhsm_repository without any privilege escalation (i.e. become).

@ansibullbot
Copy link
Collaborator

@ansibullbot ansibullbot added bug This issue/PR relates to a bug module module os packaging plugins plugin (any type) tests tests unit tests/unit labels Mar 20, 2023
@ptoscano ptoscano force-pushed the redhat_subscription-require-root branch from 7b07d8b to 9eb022f Compare March 20, 2023 19:53
subscription-manager on RHEL installs a symlink in /usr/bin to
console-helper (part of usermode), which triggers an interactive prompt
for root credentials when run as user. It seems that console-helper
does not handle well non-interactive contexts (e.g. without a TTY for
input), and thus it will hang waiting for input when run as user in an
Ansible task.

Since subscription-manager requires root already anyway (and it will
fail when explicitly run as user), then apply the same logic locally on
all the modules that interact with it: redhat_subscription,
rhsm_release, and rhsm_repository.
@ptoscano ptoscano force-pushed the redhat_subscription-require-root branch from 9eb022f to 6c995c4 Compare March 20, 2023 20:07
@github-actions
Copy link

github-actions bot commented Mar 20, 2023

Docs Build 📝

Thank you for contribution!✨

This PR has been merged and your docs changes will be incorporated when they are next published.

@felixfontein felixfontein added check-before-release PR will be looked at again shortly before release and merged if possible. backport-5 labels Mar 22, 2023
@felixfontein felixfontein merged commit 9f67cbb into ansible-collections:main Mar 22, 2023
@patchback
Copy link

patchback bot commented Mar 22, 2023

Backport to stable-5: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply 9f67cbb on top of patchback/backports/stable-5/9f67cbbe36de0c09477a600a2f513e53d81f1274/pr-6211

Backporting merged PR #6211 into main

  1. Ensure you have a local repo clone of your fork. Unless you cloned it
    from the upstream, this would be your origin remote.
  2. Make sure you have an upstream repo added as a remote too. In these
    instructions you'll refer to it by the name upstream. If you don't
    have it, here's how you can add it:
    $ git remote add upstream https://github.com/ansible-collections/community.general.git
  3. Ensure you have the latest copy of upstream and prepare a branch
    that will hold the backported code:
    $ git fetch upstream
    $ git checkout -b patchback/backports/stable-5/9f67cbbe36de0c09477a600a2f513e53d81f1274/pr-6211 upstream/stable-5
  4. Now, cherry-pick PR rhsm modules: cleanly fail when not run as root #6211 contents into that branch:
    $ git cherry-pick -x 9f67cbbe36de0c09477a600a2f513e53d81f1274
    If it'll yell at you with something like fatal: Commit 9f67cbbe36de0c09477a600a2f513e53d81f1274 is a merge but no -m option was given., add -m 1 as follows instead:
    $ git cherry-pick -m1 -x 9f67cbbe36de0c09477a600a2f513e53d81f1274
  5. At this point, you'll probably encounter some merge conflicts. You must
    resolve them in to preserve the patch from PR rhsm modules: cleanly fail when not run as root #6211 as close to the
    original as possible.
  6. Push this branch to your fork on GitHub:
    $ git push origin patchback/backports/stable-5/9f67cbbe36de0c09477a600a2f513e53d81f1274/pr-6211
  7. Create a PR, ensure that the CI is green. If it's not — update it so that
    the tests and any other checks pass. This is it!
    Now relax and wait for the maintainers to process your pull request
    when they have some cycles to do reviews. Don't worry — they'll tell you if
    any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

@felixfontein
Copy link
Collaborator

@ptoscano thanks for your contribution!

@patchback
Copy link

patchback bot commented Mar 22, 2023

Backport to stable-6: 💚 backport PR created

✅ Backport PR branch: patchback/backports/stable-6/9f67cbbe36de0c09477a600a2f513e53d81f1274/pr-6211

Backported as #6218

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

patchback bot pushed a commit that referenced this pull request Mar 22, 2023
subscription-manager on RHEL installs a symlink in /usr/bin to
console-helper (part of usermode), which triggers an interactive prompt
for root credentials when run as user. It seems that console-helper
does not handle well non-interactive contexts (e.g. without a TTY for
input), and thus it will hang waiting for input when run as user in an
Ansible task.

Since subscription-manager requires root already anyway (and it will
fail when explicitly run as user), then apply the same logic locally on
all the modules that interact with it: redhat_subscription,
rhsm_release, and rhsm_repository.

(cherry picked from commit 9f67cbb)
@felixfontein felixfontein removed the check-before-release PR will be looked at again shortly before release and merged if possible. label Mar 22, 2023
@ptoscano ptoscano deleted the redhat_subscription-require-root branch March 22, 2023 12:22
felixfontein pushed a commit that referenced this pull request Mar 22, 2023
…n not run as root (#6218)

rhsm modules: cleanly fail when not run as root (#6211)

subscription-manager on RHEL installs a symlink in /usr/bin to
console-helper (part of usermode), which triggers an interactive prompt
for root credentials when run as user. It seems that console-helper
does not handle well non-interactive contexts (e.g. without a TTY for
input), and thus it will hang waiting for input when run as user in an
Ansible task.

Since subscription-manager requires root already anyway (and it will
fail when explicitly run as user), then apply the same logic locally on
all the modules that interact with it: redhat_subscription,
rhsm_release, and rhsm_repository.

(cherry picked from commit 9f67cbb)

Co-authored-by: Pino Toscano <ptoscano@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug This issue/PR relates to a bug module module os packaging plugins plugin (any type) tests tests unit tests/unit
Projects
None yet
Development

Successfully merging this pull request may close these issues.

redhat_subscription doesn't exit with error, if privilege escalation is not enabled.
3 participants