Merge pull request #424 from nextcloud/fix/ansible-core-2.19

fix regression on ansible-core 2.19+ by improving how the module switches to the owner of occ to run commands

Author: aalaesar

plugins/module_utils/nc_tools.py

@@ -24,6 +24,7 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 import os
+from multiprocessing import Process, Pipe
 from ansible_collections.nextcloud.admin.plugins.module_utils.exceptions import (
     OccExceptions,
     OccAuthenticationException,
@@ -60,38 +61,83 @@ def convert_string(command: str) -> list:
     return [token if " " in token else token.strip("\"'") for token in command_lex]
 
 
+def execute_occ_command(conn, module, php_exec, command):
+    """
+    Execute a given occ command using the PHP interpreter and handle user permissions.
+
+    This function attempts to runs occ through the PHP interpreter with
+    the appropriate user permissions. It checks if the current user has the same
+    UID as the owner of the occ file, switches to that user if necessary,
+    and runs the command. The output of the command execution along with any
+    errors are sent back via the provided connection object.
+
+    Parameters:
+    - conn (multiprocessing.connection.Connection): The connection object used for communication.
+    - module (AnsibleModule): An object providing methods for running commands.
+    - php_exec (str): The path to the PHP executable.
+    - command (list): A list where the first element is 'occ' with its full path.
+
+    Raises:
+    - OccFileNotFoundException: If the command file does not exist.
+    - OccAuthenticationException: If there are insufficient permissions to switch the user.
+
+    Returns:
+    None: This function does not return anything. It sends the results or exceptions through the conn object.
+    """
+    try:
+        cli_stats = os.stat(command[0])
+        if os.getuid() != cli_stats.st_uid:
+            os.setgid(cli_stats.st_gid)
+            os.setuid(cli_stats.st_uid)
+
+        rc, stdout, stderr = module.run_command([php_exec] + command)
+        conn.send({"rc": rc, "stdout": stdout, "stderr": stderr})
+    except FileNotFoundError:
+        conn.send({"exception": "OccFileNotFoundException"})
+    except PermissionError:
+        conn.send(
+            {
+                "exception": "OccAuthenticationException",
+                "msg": f"Insufficient permissions to switch to user id {cli_stats.st_uid}.",
+            }
+        )
+    except Exception as e:
+        conn.send({"exception": str(e)})
+    finally:
+        conn.close()
+
+
 def run_occ(
     module,
     command,
 ):
     cli_full_path = module.params.get("nextcloud_path") + "/occ"
     php_exec = module.params.get("php_runtime")
-    try:
-        cli_stats = os.stat(cli_full_path)
-    except FileNotFoundError:
-        raise OccFileNotFoundException()
-
-    if os.getuid() != cli_stats.st_uid:
-        module.debug(f"DEBUG: Switching user to id {cli_stats.st_uid}.")
-        try:
-            os.setgid(cli_stats.st_gid)
-            os.setuid(cli_stats.st_uid)
-        except PermissionError:
-            raise OccAuthenticationException(
-                msg="Insufficient permissions to switch to user id {}.".format(
-                    cli_stats.st_uid
-                )
-            )
-
     if isinstance(command, list):
-        full_command = [cli_full_path] + ["--no-ansi"] + command
+        full_command = [cli_full_path, "--no-ansi"] + command
     elif isinstance(command, str):
-        full_command = [cli_full_path] + ["--no-ansi"] + convert_string(command)
+        full_command = [cli_full_path, "--no-ansi"] + convert_string(command)
 
-    module.debug(f"DEBUG: Running command '{[php_exec] + full_command}'.")
-    result = dict(
-        zip(("rc", "stdout", "stderr"), module.run_command([php_exec] + full_command))
+    # execute the occ command in a child process to keep current privileges
+    module_conn, occ_conn = Pipe()
+    p = Process(
+        target=execute_occ_command, args=(occ_conn, module, php_exec, full_command)
     )
+    p.start()
+    result = module_conn.recv()
+    p.join()
+
+    # check if the child process has sent an exception.
+    if "exception" in result:
+        exception_type = result["exception"]
+        # raise the proper exception.
+        if exception_type == "OccFileNotFoundException":
+            raise OccFileNotFoundException(full_command)
+        elif exception_type == "OccAuthenticationException":
+            raise OccAuthenticationException(full_command, **result)
+        else:
+            raise OccExceptions(f"An unknown error occurred: {exception_type}")
+
     if "is in maintenance mode" in result["stderr"]:
         module.warn(" ".join(result["stderr"].splitlines()[0:1]))
         maintenanceMode = True