<p dir="auto"><em>From <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/chriskarel/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/chriskarel">@chriskarel</a> on November 3, 2016 19:21</em></p>

<h5 dir="auto">ISSUE TYPE</h5>

<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">User module</p>
<h5 dir="auto">ANSIBLE VERSION</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="# ansible --version
ansible 2.1.2.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = Default w/o overrides
"><pre class="notranslate"><code class="notranslate"># ansible --version
ansible 2.1.2.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = Default w/o overrides

</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>

<p dir="auto">Nothing unusual</p>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<p dir="auto">OEL/RHEL 7</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">Using the user module on an existing user, but changing their home directory, results in the new home directory created with improper filesystem permissions and SELinux types.</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<p dir="auto">Have an existing user, with an existing home directory setting.  Then use the Ansible user module to change that home directory.  The new directory will be created, but with the same permissions and SELinux values as the parent directory, rather than the usual home settings.</p>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="# cat bugtest.yaml 

---
- name: Showcase bug
  hosts: all
  tasks:
    - name: Create system accounts
      user:
        name={{item}}
        home=/home/{{item}}
        state=present
      with_items:
         - user_existing
         - user_not_existing


# useradd -d /home/userold user_existing
# ls -lZd /home/user*
drwx------. user_existing user_existing unconfined_u:object_r:user_home_dir_t:s0 /home/userold

&lt;run the above playbook for this host&gt;

# ls -lZd /home/user*
drwxr-xr-x. user_existing     user_existing     unconfined_u:object_r:home_root_t:s0 /home/user_existing
drwx------. user_not_existing user_not_existing unconfined_u:object_r:user_home_dir_t:s0 /home/user_not_existing
drwx------. user_existing     user_existing     unconfined_u:object_r:user_home_dir_t:s0 /home/userold
"><pre class="notranslate"><code class="notranslate"># cat bugtest.yaml 

---
- name: Showcase bug
  hosts: all
  tasks:
    - name: Create system accounts
      user:
        name={{item}}
        home=/home/{{item}}
        state=present
      with_items:
         - user_existing
         - user_not_existing


# useradd -d /home/userold user_existing
# ls -lZd /home/user*
drwx------. user_existing user_existing unconfined_u:object_r:user_home_dir_t:s0 /home/userold

&lt;run the above playbook for this host&gt;

# ls -lZd /home/user*
drwxr-xr-x. user_existing     user_existing     unconfined_u:object_r:home_root_t:s0 /home/user_existing
drwx------. user_not_existing user_not_existing unconfined_u:object_r:user_home_dir_t:s0 /home/user_not_existing
drwx------. user_existing     user_existing     unconfined_u:object_r:user_home_dir_t:s0 /home/userold

</code></pre></div>

<h5 dir="auto">EXPECTED RESULTS</h5>

<p dir="auto">I would expect the new home directory that is created for an existing user would have similar permissions and SELinux values as a new home directory created for a brand new user.  (eg: permissions of 0700, type of user_home_dir_t)<br>
This also impacts the .ssh directory, if generate_ssh_key is true.  I would expect the .ssh directory to have ssh_home_t type, but it does not.</p>
<h5 dir="auto">ACTUAL RESULTS</h5>

<p dir="auto">The new home directory inherits the parent's permissions and SELinux context.  In this case, that's mode 0755 and home_root_t, the same as /home/.  /home/user_existing/ should look more like /home/userold/.</p>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="# ls -lZd /home/user*
drwxr-xr-x.   user_existing     user_existing     unconfined_u:object_r:home_root_t:s0 /home/user_existing
drwx------.   user_not_existing user_not_existing unconfined_u:object_r:user_home_dir_t:s0 /home/user_not_existing
drw-------.   user_existing     user_existing     unconfined_u:object_r:user_home_dir_t:s0 /home/userold"><pre class="notranslate"><code class="notranslate"># ls -lZd /home/user*
drwxr-xr-x.   user_existing     user_existing     unconfined_u:object_r:home_root_t:s0 /home/user_existing
drwx------.   user_not_existing user_not_existing unconfined_u:object_r:user_home_dir_t:s0 /home/user_not_existing
drw-------.   user_existing     user_existing     unconfined_u:object_r:user_home_dir_t:s0 /home/userold
</code></pre></div>
<p dir="auto"><em>Copied from original issue: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="187165603" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible-modules-core/issues/5481" data-hovercard-type="issue" data-hovercard-url="/ansible/ansible-modules-core/issues/5481/hovercard" href="https://github.com/ansible/ansible-modules-core/issues/5481">ansible/ansible-modules-core#5481</a></em></p>
<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">route53 module</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.2.3.0"><pre class="notranslate"><code class="notranslate">ansible 2.2.3.0
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>
<p dir="auto">N/A</p>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<p dir="auto">N/A</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">When you have "duplicate" hosted zones in route53 and use <code class="notranslate">command=get</code> and the <code class="notranslate">hosted_zone_id</code> parameter, it gets ignored when looking up the nameservers for the zone. For some reason, instead of using the zone object that was already looked up (using the module's <code class="notranslate">get_zone_by_name()</code> function), a separate lookup is done using only the name (using the boto <code class="notranslate">conn.get_zone()</code> function), which ends up getting the wrong zone in this corner case.</p>
<p dir="auto">The fix should be relatively simple. Instead of doing another lookup for the zone, the existing <code class="notranslate">zone</code> var should just be used for the <code class="notranslate">.get_nameservers()</code> call.</p>
<p dir="auto"></p><div class="Box Box--condensed my-2">
  <div class="Box-header f6">
    <p class="mb-0 text-bold">
      <a href="https://github.com/ansible/ansible/blob/74f6b64fb06762b934c71e65ffece526f08399ff/lib/ansible/modules/cloud/amazon/route53.py#L583">ansible/lib/ansible/modules/cloud/amazon/route53.py</a>
    </p>
    <p class="mb-0 color-fg-muted">
         Line 583
      in
      <a data-pjax="true" class="commit-tease-sha" href="/ansible/ansible/commit/74f6b64fb06762b934c71e65ffece526f08399ff">74f6b64</a>
    </p>
  </div>
  <div itemprop="text" class="Box-body p-0 blob-wrapper blob-wrapper-embedded data">
    <table class="highlight tab-size mb-0 js-file-line-container" data-tab-size="8" data-paste-markdown-skip="">

        <tbody><tr class="border-0">
          <td id="L583" class="blob-num border-0 px-3 py-0 color-bg-default" data-line-number="583"></td>
          <td id="LC583" class="blob-code border-0 px-3 py-0 color-bg-default blob-code-inner js-file-line"> <span class="pl-s1">z</span> <span class="pl-c1">=</span> <span class="pl-en">invoke_with_throttling_retries</span>(<span class="pl-s1">conn</span>.<span class="pl-s1">get_zone</span>, <span class="pl-s1">zone_in</span>) </td>
        </tr>
    </tbody></table>
  </div>
</div>
<p></p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<p dir="auto">N/A</p>
<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">N/A</p>
<h5 dir="auto">ACTUAL RESULTS</h5>
<p dir="auto">N/A</p>