commit 85a2b047775b9e61d65109dba6a936bb8b82ae06
parent 7b5fe4525007459fc669eebca930150b1c1635f3
Author: Asher Morgan <asher@ashermorgan.net>
Date: Thu, 10 Sep 2026 18:13:15 -0700
Update option whitelist and add option checks
Diffstat:
4 files changed, 41 insertions(+), 16 deletions(-)
diff --git a/README.md b/README.md
@@ -114,14 +114,22 @@ main.yml: # The playbook name
output: true
# The ansible-playbooks options that users are allowed to invoke. Short and
- # long option forms must be specified separately. A reasonable set of safe
- # options are allowed by default, see aoh/security.py.
+ # long option forms must be specified separately. The following options are
+ # allowed by default:
+ # --ask-become-pass / -K
+ # --ask-pass / -k
+ # --ask-vault-password / --ask-vault-pass / -J
+ # --check / -C
+ # --diff / -D
+ # --list-tags
+ # --skip-tags
+ # --start-at-task
+ # --tags / -t
allow_opts:
- '--become-method'
- # A list of ansible-playbook options that users are not allowed to invoke.
- # This overrides the default allowed options and the options specified in
- # allow_opts. Some options are always blocked, see aoh/security.py.
+ # A list of ansible-playbook options that users are not allowed to invoke,
+ # overriding the default allowed options.
block_opts:
- '--list-tags'
diff --git a/aoh/playbook.py b/aoh/playbook.py
@@ -3,6 +3,7 @@ import os
import yaml
from .config import AOH_PLAYBOOKS_FILE
+from .security import CLI_OPT_BLACKLIST
_PLAYBOOKS_DIR = os.path.dirname(AOH_PLAYBOOKS_FILE)
@@ -65,6 +66,14 @@ class Playbook:
raise PlaybookError('extra_args cannot contain "--limit" if '
'limit is true')
+ for opt in CLI_OPT_BLACKLIST:
+ if opt in self.allow_opts:
+ raise PlaybookError(f'The "{opt}" option is not supported and '
+ 'cannot be included in allow_opts')
+ if opt in self.extra_args:
+ raise PlaybookError(f'The "{opt}" option is not supported and '
+ 'cannot be included in extra_args')
+
def get_playbook(name):
"""Lookup a playbook configuration."""
diff --git a/aoh/security.py b/aoh/security.py
@@ -4,7 +4,7 @@ import yaml
from .config import AOH_PASSWORDS_FILE
from .runner import get_config_values
-_CLI_OPT_WHITELIST = [
+CLI_OPT_WHITELIST = [
# These options should be safe for clients to invoke
'--ask-become-pass', '-K',
'--ask-pass', '-k',
@@ -15,11 +15,11 @@ _CLI_OPT_WHITELIST = [
'--skip-tags',
'--start-at-task',
'--tags', '-t',
- '--verbose', '-v',
- '--version',
+
+ # New entries should also be added to README.md
]
-_CLI_OPT_BLACKLIST = [
+CLI_OPT_BLACKLIST = [
'--step', # Interactive, not supported
]
@@ -69,8 +69,8 @@ def validate_args(playbook, args):
return False
for opt in _get_opts(args):
- if (not (opt in _CLI_OPT_WHITELIST or opt in playbook.allow_opts) or
- (opt in _CLI_OPT_BLACKLIST or opt in playbook.block_opts)):
+ if (not (opt in CLI_OPT_WHITELIST or opt in playbook.allow_opts) or
+ (opt in CLI_OPT_BLACKLIST or opt in playbook.block_opts)):
return False
return True
diff --git a/demo/playbooks.yml b/demo/playbooks.yml
@@ -32,14 +32,22 @@ main.yml: # The playbook name
output: true
# The ansible-playbooks options that users are allowed to invoke. Short and
- # long option forms must be specified separately. A reasonable set of safe
- # options are allowed by default, see aoh/security.py.
+ # long option forms must be specified separately. The following options are
+ # allowed by default:
+ # --ask-become-pass / -K
+ # --ask-pass / -k
+ # --ask-vault-password / --ask-vault-pass / -J
+ # --check / -C
+ # --diff / -D
+ # --list-tags
+ # --skip-tags
+ # --start-at-task
+ # --tags / -t
allow_opts:
- '--become-method'
- # A list of ansible-playbook options that users are not allowed to invoke.
- # This overrides the default allowed options and the options specified in
- # allow_opts. Some options are always blocked, see aoh/security.py.
+ # A list of ansible-playbook options that users are not allowed to invoke,
+ # overriding the default allowed options.
block_opts:
- '--list-tags'
