Skip to content

Detect if we're being called via Ansible

Andrew Ruthven requested to merge puck/molly-guard:conf-mgmt into master

Ansible uses an interactive shell, so the logic in run.d/30-query-hostname to skip it if being called by a non-interactive shell doesn't detect Ansible and therefore runs. The approach recommended by Ansible folks if molly-guard is installed is to set the search path to /lib/molly-guard and use the unprotected commands[0][1].

This is a bit unfortunate because it means that if other molly-guard snippets are added, then they aren't checked on an Ansible driven reboot.

This commit adds logic that'll look for Ansible and set a flag so that 30-query-hostname, and potentially other snippets, can be skipped.

I have also filed a bug in BTS for this: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1053438

[0] https://docs.ansible.com/ansible/8/collections/ansible/builtin/reboot_module.html [1] https://github.com/ansible/ansible/issues/51190

Merge request reports

Loading