我正在尝试使用 ansible 更改权限，但效果不佳

Question

我有这个工作正常的剧本，但不是我需要的，我找不到问题。 该剧本应该允许我以递归方式更改文件系统的权限，或者更改特定文件的权限。

- name: Playbook to change file and directory permissions
  hosts: '{{ target_hosts }}'
  vars:
    PATH: '{{ target_path }}'
    PERMISSIONS: '{{ number }}'
    OWNER: '{{ target_owner }}'
    GROUP: '{{ target_group }}'
  tasks:
    - name: Checking that it is not a system mount point
      fail: 
        msg: "Changing permissions on system fs is not allowed"
      when: PATH in ["/etc", "/var", "/tmp", "/usr", "/", "/opt", "/home", "/boot"]

    - name: Checking if the path is a file or a filesystem
      stat: 
        path: '{{ PATH }}'
      register: path_status

    - name: Applying permissions on the filesystem
      block:
        - name: Report if directory exists 
          debug: 
            msg: "Directory {{ PATH }} is present on the server"
          when: path_status.stat.exists

        - name: Applying permissions recursively
          file: 
            path: '{{ PATH }}'
            mode: '0{{ PERMISSIONS }}'
            owner: '{{ OWNER }}'
            group: '{{ GROUP }}'
            recurse: yes
      when: path_status.stat.isdir is defined and path_status.stat.isdir

    - name: Applying permissions on the file
      block:
        - name: Report if file exists
          debug:
            msg: "File {{ PATH }} is present on the server" 
          when: path_status.stat.exists

        - name: Applying permissions
          file: 
            path: '{{ PATH }}'
            state: file
            mode: '0{{ PERMISSIONS }}'
            owner: '{{ OWNER }}'
            group: '{{ GROUP }}'
      when: path_status.stat.isreg is defined and path_status.stat.isreg

前 2 个任务

• 验证它不是系统文件系统
• 使用 Ansible stat 模块，我注册了正在运行的路径 作为 PATH 变量的参数传递

当我执行时只传递一个文件系统，如下例所示

ansible-playbook change_fs_permissions.yml -e "target_hosts=centoslabs target_path=/etc number=755 target_owner=root target_group=testing"

执行结束，因为它是一个系统挂载点。 （我期待什么）

但是，如果我输入类似 /tmp/somefile.txt 之类的内容作为 PATH 变量的参数，我的想法是 playbook 将再次失败，因为它无法更改该文件系统中的任何内容，但确实如此不继续执行并更改权限。

他们会看到我使用 BLOCK 模块，因为在我看来它是最好的，因此如果将文件系统传递给它，它会执行这些任务，如果它是一个文件，它会执行其他任务。

你能给我一些关于如何解决这个问题的想法吗？

Answer 1

简化条件

  when: path_status.stat.isdir is defined and path_status.stat.isdir
  when: path_status.stat.isreg is defined and path_status.stat.isreg

不要测试是否定义了属性，而是将默认设置为false。这将跳过 PATH 既不是目录也不是常规文件的情况。

  when: path_status.stat.isdir|default(false)
  when: path_status.stat.isreg|default(false)

在这种情况下，您也可以省略测试 PATH 是否存在，因为如果它不存在，则无论如何都会跳过该块

  when: path_status.stat.exists

---

试试这个

    - name: Applying permissions on the filesystem
      block:
        - name: Report if directory exists
          debug:
            msg: "Directory {{ PATH }} is present on the server"

        - name: Applying permissions recursively
          file:
            path: '{{ PATH }}'
            mode: '0{{ PERMISSIONS }}'
            owner: '{{ OWNER }}'
            group: '{{ GROUP }}'
            recurse: true
      when: path_status.stat.isdir|default(false)

    - name: Applying permissions on the file
      block:
        - name: Report if file exists
          debug:
            msg: "File {{ PATH }} is present on the server"

        - name: Applying permissions
          file:
            path: '{{ PATH }}'
            state: file
            mode: '0{{ PERMISSIONS }}'
            owner: '{{ OWNER }}'
            group: '{{ GROUP }}'
      when: path_status.stat.isreg|default(false)

Answer 2

我做到了，它现在正在工作。 我所做的是改变这部分：

  - name: Checking that it is not a system mount point
  fail: 
    msg: "Changing permissions on system fs is not allowed"
  when: PATH in ["/etc", "/var", "/tmp", "/usr", "/", "/opt", "/home", "/boot"]

为：

  - name: Checking that it is not a system mount point
  fail: 
    msg: "Changing permissions on system fs is not allowed"
  when: PATH.split('/')[1] in ["/etc", "/var", "/tmp", "/usr", "/", "/opt", "/home", "/boot"]