zware/awx
1
0
Fork 0
mirror of https://github.com/ZwareBear/awx.git synced 2026-04-23 16:31:50 -05:00
Code Issues Packages Projects Releases Wiki Activity

bind ansible and awx virtualenvs readonly so that jobs can't modify them

Browse Source 
see: https://github.com/ansible/ansible-tower/issues/7558
This commit is contained in:
Ryan Petrello
2017-09-06 14:12:47 -07:00
parent a2ca0e6012
commit a9c9ecb5ea
2 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
awx/main/utils/common.py
View File

@@ -699,7 +699,11 @@ def wrap_args_with_proot(args, cwd, **kwargs):
show_paths = [cwd, kwargs['private_data_dir']]
else:
show_paths = [cwd]
show_paths.extend([settings.ANSIBLE_VENV_PATH, settings.AWX_VENV_PATH])
for venv in (
settings.ANSIBLE_VENV_PATH,
settings.AWX_VENV_PATH
):
new_args.extend(['--ro-bind', venv, venv])
show_paths.extend(getattr(settings, 'AWX_PROOT_SHOW_PATHS', None) or [])
show_paths.extend(kwargs.get('proot_show_paths', []))
for path in sorted(set(show_paths)):