Correct code example for resolving risky-file-permissions does not pass lint

[jamescooke]

Summary

Correct code example 2 for risky-file-permissions does not pass ansible-lint - raises yaml[key-duplicates].

Issue Type

• Bug Report

OS / ENVIRONMENT

ansible-lint --version
ansible-lint 6.12.1 using ansible 2.14.1

• ansible installation method: pip
• ansible-lint installation method: pip

STEPS TO REPRODUCE

# Make a dir
mkdir -p roles/repro/tasks
# Write the correct code to main.yaml
cat > roles/repro/tasks/main.yaml

---
- name: Safe example of using ini_file (1st solution)
  community.general.ini_file:
    path: foo
    create: false  # prevents creating a file with potentially insecure permissions
    mode: preserve

- name: Safe example of using ini_file (2nd solution)
  community.general.ini_file:
    path: foo
    mode: 0600  # explicitly sets the desired permissions, to make the results predictable
    mode: preserve

# Lint roles
ansible-lint roles/

Desired Behavior

Linting passes with 0 errors - this is the "correct" code.

Linting passes with no warnings, especially not warnings regarding the risky-file-permissions error type that we're reading the documentation trying to fix.

Actual Behavior

Linting fails with 1 error (and two warnings which are also concerning)

Error:

yaml[key-duplicates]: Duplication of key "mode" in mapping
roles/repro/tasks/main.yaml:12

Full output:

[WARNING]: While constructing a mapping from <unicode string>, line 10, column 5, found a duplicate dict key (mode). Using last defined value
only.
[WARNING]: While constructing a mapping from /tmp/alintbug/roles/repro/tasks/main.yaml, line 10, column 5, found a duplicate dict key (mode).
Using last defined value only.
WARNING  Unable to load module community.general.ini_file at roles/repro/tasks/main.yaml:2 for options validation
WARNING  Unable to load module community.general.ini_file at roles/repro/tasks/main.yaml:8 for options validation
WARNING  Unable to resolve FQCN for module community.general.ini_file
WARNING  Listing 3 violation(s) that are fatal
risky-file-permissions: File permissions unset or incorrect. (warning)
roles/repro/tasks/main.yaml:2 Task/Handler: Safe example of using ini_file (1st solution)

risky-file-permissions: File permissions unset or incorrect. (warning)
roles/repro/tasks/main.yaml:8 Task/Handler: Safe example of using ini_file (2nd solution)

yaml[key-duplicates]: Duplication of key "mode" in mapping
roles/repro/tasks/main.yaml:12

You can skip specific rules or tags by adding them to your configuration file:
# .config/ansible-lint.yml
warn_list:  # or 'skip_list' to silence them completely
  - experimental  # all rules tagged as experimental
  - yaml[key-duplicates]  # Violations reported by yamllint.

                            Rule Violation Summary                             
 count tag                    profile rule associated tags                     
     1 yaml[key-duplicates]   basic   formatting, yaml                         
     2 risky-file-permissions safety  unpredictability, experimental (warning) 

Failed after min profile: 1 failure(s), 2 warning(s) on 2 files.

[ssbarnea]

Please, read again your example and the error.

[jamescooke]

Hi @AKorezin

There's indeed dupe mode here.

Thanks for confirming - which one do you think should be removed? My guess was the second, but I've not seen this error before.

[AKorezin]

For me, this is not a trivial task.
To complete it, one must answer these questions

1. Do other modules, except ansible.builtin.copy, support mode: preserve?
2. Will mode: 0600 trigger File permissions unset or incorrect.?
3. Is it safe to use mode: preserve?

[adamchainz]

Re: #1: It doesn't look like it. 'preserve' has special handling inside copy: https://github.com/ansible/ansible/blob/d47a848219fa357ba8740191903b5538d460082e/lib/ansible/modules/copy.py#L575-L576 .

Other modules load mode via load_common_file_arguments: https://github.com/ansible-collections/community.general/blob/b1d9507cd2986cc2f3e9d918a56477ef2eba3d1f/plugins/modules/ini_file.py#L467 , and then set it with set_mode_if_different: https://github.com/ansible/ansible/blob/d47a848219fa357ba8740191903b5538d460082e/lib/ansible/module_utils/basic.py#L889 . This second function doesn't support 'preserve'.

So the line to remove here is mode: preserve...

[AKorezin]

So the correct code for the documentation should be

--- a/src/ansiblelint/rules/risky_file_permissions.md
+++ b/src/ansiblelint/rules/risky_file_permissions.md
@@ -36,7 +36,6 @@ Modules that are checked:
   community.general.ini_file:
     path: foo
     create: true
-    mode: preserve
 ```
 
 ## Correct code
@@ -47,11 +46,16 @@ Modules that are checked:
   community.general.ini_file:
     path: foo
     create: false  # prevents creating a file with potentially insecure permissions
-    mode: preserve
 
 - name: Safe example of using ini_file (2nd solution)
   community.general.ini_file:
     path: foo
+    create: true
     mode: 0600  # explicitly sets the desired permissions, to make the results predictable
-    mode: preserve
+
+- name: Safe example of using copy (3nd solution)
+  ansible.builtin.copy:
+    src: foo
+    dest: bar
+    mode: preserve   # copy has a special mode that sets the same permissions as the source file
 ```

[jamescooke]

Hi both - thanks for your help. I've opened #3078 with your patch @AKorezin .

[ssbarnea]

Please make a PR to remove the offending line from example.