fix: use no_log option for include_vars (CVE-2024-8775)

chronicc · Oct 27, 2024 · e68ddbc · e68ddbc
1 parent 68e4e2e
commit e68ddbc
Show file tree

Hide file tree

Showing 9 changed files with 12 additions and 0 deletions.
diff --git a/playbooks/00-initialize-node.yml b/playbooks/00-initialize-node.yml
@@ -19,6 +19,7 @@
             - '{{ ansible_distribution }}.yml'
           paths:
             - ../vars
+      no_log: true
       tags:
         - always
 

diff --git a/playbooks/10-server.yml b/playbooks/10-server.yml
@@ -12,6 +12,7 @@
             - '{{ ansible_distribution }}.yml'
           paths:
             - ../vars
+      no_log: true
       tags:
         - always
 

diff --git a/playbooks/10-workstations.yml b/playbooks/10-workstations.yml
@@ -20,6 +20,7 @@
             - '{{ ansible_distribution }}.yml'
           paths:
             - ../vars
+      no_log: true
       tags:
         - always
 

diff --git a/playbooks/20-install-fonts.yml b/playbooks/20-install-fonts.yml
@@ -20,6 +20,7 @@
             - '{{ ansible_distribution }}.yml'
           paths:
             - ../vars
+      no_log: true
       tags:
         - always
 

diff --git a/playbooks/20-setup-minecraft-server.yml b/playbooks/20-setup-minecraft-server.yml
@@ -12,6 +12,7 @@
             - '{{ ansible_distribution }}.yml'
           paths:
             - ../vars
+      no_log: true
       tags:
         always
 

diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
@@ -8,6 +8,7 @@
         - '{{ ansible_distribution | lower }}.yml'
       paths:
         - ../vars
+  no_log: true
 
 - name: Include OS-specific tasks
   ansible.builtin.include_tasks: '{{ lookup("ansible.builtin.first_found", params) }}'
@@ -18,3 +19,4 @@
         - '{{ ansible_distribution | lower }}.yml'
       paths:
         - .
+  no_log: true
diff --git a/roles/init/tasks/main.yml b/roles/init/tasks/main.yml
@@ -8,6 +8,7 @@
         - '{{ ansible_distribution | lower }}.yml'
       paths:
         - ../vars
+  no_log: true
 
 - name: Include OS-specific tasks
   ansible.builtin.include_tasks: '{{ lookup("ansible.builtin.first_found", params) }}'
@@ -18,3 +19,4 @@
         - '{{ ansible_distribution | lower }}.yml'
       paths:
         - .
+  no_log: true
diff --git a/roles/pkg/tasks/main.yml b/roles/pkg/tasks/main.yml
@@ -8,6 +8,7 @@
         - '{{ ansible_distribution | lower }}.yml'
       paths:
         - ../vars
+  no_log: true
 
 - name: Include OS-specific tasks
   ansible.builtin.include_tasks: '{{ lookup("ansible.builtin.first_found", params) }}'
@@ -18,3 +19,4 @@
         - '{{ ansible_distribution | lower }}.yml'
       paths:
         - .
+  no_log: true
diff --git a/roles/ssh/tasks/main.yml b/roles/ssh/tasks/main.yml
@@ -19,6 +19,7 @@
         - main.yaml
       paths:
         - ../vars
+  no_log: true
 
 - name: Include target tasks
   ansible.builtin.include_tasks: '{{ _target }}.yml'