Repository: ansible/ansible

Issue:
pamd module fails on 2.6 and master (2.7)
<!---
Verify first that your issue/request is not already reported on GitHub.
THIS FORM WILL BE READ BY A MACHINE, COMPLETE ALL SECTIONS AS DESCRIBED.
Also test if the latest release, and devel branch are affected too.
ALWAYS add information AFTER (OUTSIDE) these html comments.
Otherwise it may end up being automatically closed by our bot. -->

##### SUMMARY
<!--- Explain the problem briefly -->
"TypeError: 'bool' object is not callable" when trying to use pamd module

##### ISSUE TYPE
 - Bug Report

##### COMPONENT NAME
<!--- Insert, BELOW THIS COMMENT, the name of the module, plugin, task or feature.
Do not include extra details here, e.g. "vyos_command" not "the network module vyos_command" or the full path-->
pamd

##### ANSIBLE VERSION
<!--- Paste, BELOW THIS COMMENT, verbatim output from "ansible --version" between quotes below -->
```
ansible 2.6.0.dev0 (stable-2.6 db3a3ddfa9) last updated 2018/06/06 06:57:48 (GMT -400)
  config file = /home/user/.ansible.cfg
  configured module search path = [u'/home/user/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /home/user/ansible-ansible/lib/ansible
  executable location = /home/user/ansible-ansible/bin/ansible
  python version = 2.7.5 (default, Apr 11 2018, 07:36:10) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)]
```

##### CONFIGURATION
<!--- If using Ansible 2.4 or above, paste, BELOW THIS COMMENT, the results of "ansible-config dump --only-changed"
Otherwise, mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).-->
```
ANSIBLE_PIPELINING(/home/user/.ansible.cfg) = True
DEFAULT_FORKS(/home/user/.ansible.cfg) = 250
DEFAULT_GATHER_SUBSET(/home/user/.ansible.cfg) = virtual
DEFAULT_HOST_LIST(/home/user/.ansible.cfg) = [u'/home/user/ansible/inventory']
DEFAULT_ROLES_PATH(/home/user/.ansible.cfg) = [u'/home/user/ansible/roles']
DEFAULT_STDOUT_CALLBACK(/home/user/.ansible.cfg) = debug
DEFAULT_VAULT_PASSWORD_FILE(/home/user/.ansible.cfg) = /srv/private/vault-password-file
PERSISTENT_CONNECT_TIMEOUT(/home/user/.ansible.cfg) = 30
```

##### OS / ENVIRONMENT
<!--- Mention, BELOW THIS COMMENT, the OS you are running Ansible from, and the OS you are
managing, or say "N/A" for anything that is not platform-specific.
Also mention the specific version of what you are trying to control,
e.g. if this is a network bug the version of firmware on the network device.-->
RHEL 7 -> RHEL 7

##### STEPS TO REPRODUCE
<!--- For bugs, show exactly how to reproduce the problem, using a minimal test-case.
For new features, show how the feature would be used. -->

<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: "MEDIUM | RHEL-07-010200 | PATCH | The PAM system service must be configured to store only encrypted representations of passwords."
  pamd:
      name: system-auth
      state: "{{ item.state }}"
      type: password
      control: sufficient
      module_path: pam_unix.so
      module_arguments: "{{ item.args }}"
  with_items:
      - state: args_present
        args:
            - "sha512"
      - state: args_absent
        args:
            - "md5"
            - "bigcrypt"
            - "sha256"
            - "blowfish"
  when: rhel_07_010200
  tags:
      - RHEL-07-010200
      - pamd
```

<!--- You can also paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- What did you expect to happen when running the steps above? -->
success, works as on 2.4 and 2.5.

```
Using module file /home/user/ansible-ansible/lib/ansible/modules/system/pamd.py
<g104boom03> ESTABLISH SSH CONNECTION FOR USER: grp104dom
<g104boom03> SSH: EXEC sshpass -d12 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o User=grp104dom -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o ControlPath=/home/user/.ansible/cp/30e62eb7aa g104boom03 '/bin/sh -c '"'"'sudo -H -S  -p "[sudo via ansible, key=nqtqpqnhakfumqloxjqtyrqrbgidrjqy] password: " -u root /bin/sh -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-nqtqpqnhakfumqloxjqtyrqrbgidrjqy; /usr/bin/python'"'"'"'"'"'"'"'"' && sleep 0'"'"''
Escalation succeeded
<g104boom03> (0, '\n{"invocation": {"module_args": {"control": "sufficient", "new_module_path": null, "name": "system-auth", "dest": "/etc/pam.d/system-auth", "module_path": "pam_unix.so", "new_type": null, "state": "args_present", "new_control": null, "path": "/etc/pam.d", "type": "password", "module_arguments": ["remember=5"]}}, "changed": true, "ansible_facts": {"pamd": {"changed": true, "result": {"action": "args_present", "to_rule_0": "password  \\tsufficient\\tpam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5", "added_arg_0": "remember=5", "change_count": 1}}}}\n', '')
changed: [g104boom03] => {
    "ansible_facts": {
        "pamd": {
            "changed": true,
            "result": {
                "action": "args_present",
                "added_arg_0": "remember=5",
                "change_count": 1,
                "to_rule_0": "password  \tsufficient\tpam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5"
            }
        }
    },
    "changed": true,
    "invocation": {
        "module_args": {
            "control": "sufficient",
            "dest": "/etc/pam.d/system-auth",
            "module_arguments": [
                "remember=5"
            ],
            "module_path": "pam_unix.so",
            "name": "system-auth",
            "new_control": null,
            "new_module_path": null,
            "new_type": null,
            "path": "/etc/pam.d",
            "state": "args_present",
            "type": "password"
        }
    }
}
```

##### ACTUAL RESULTS
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes below -->
```
Using module file /home/user/ansible-ansible/lib/ansible/modules/system/pamd.py
<g104boom03> ESTABLISH SSH CONNECTION FOR USER: grp104dom
<g104boom03> SSH: EXEC sshpass -d12 ssh -C -o ControlMaster=auto -o ControlPersist=60s -o User=grp104dom -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o ControlPath=/home/user/.ansible/cp/30e62eb7aa g104boom03 '/bin/sh -c '"'"'sudo -H -S  -p "[sudo via ansible, key=pzsfzatvnmpciwwlgekohxglorvydrhb] password: " -u root /bin/sh -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-pzsfzatvnmpciwwlgekohxglorvydrhb; /usr/bin/python'"'"'"'"'"'"'"'"' && sleep 0'"'"''
Escalation succeeded
<g104boom03> (1, '', 'Traceback (most recent call last):\n  File "/tmp/ansible_ZT35_y/ansible_module_pamd.py", line 785, in <module>\n    main()\n  File "/tmp/ansible_ZT35_y/ansible_module_pamd.py", line 752, in main\n    valid, msg = service.validate()\n  File "/tmp/ansible_ZT35_y/ansible_module_pamd.py", line 656, in validate\n    if not current_line.is_valid()[0]:\nTypeError: \'bool\' object is not callable\n')
The full traceback is:
Traceback (most recent call last):
  File "/tmp/ansible_ZT35_y/ansible_module_pamd.py", line 785, in <module>
    main()
  File "/tmp/ansible_ZT35_y/ansible_module_pamd.py", line 752, in main
    valid, msg = service.validate()
  File "/tmp/ansible_ZT35_y/ansible_module_pamd.py", line 656, in validate
    if not current_line.is_valid()[0]:
TypeError: 'bool' object is not callable

failed: [g104boom03] (item={u'state': u'args_present', u'args': [u'sha512']}) => {
    "changed": false,
    "item": {
        "args": [
            "sha512"
        ],
        "state": "args_present"
    },
    "rc": 1
}

MSG:

MODULE FAILURE


MODULE_STDERR:

Traceback (most recent call last):
  File "/tmp/ansible_ZT35_y/ansible_module_pamd.py", line 785, in <module>
    main()
  File "/tmp/ansible_ZT35_y/ansible_module_pamd.py", line 752, in main
    valid, msg = service.validate()
  File "/tmp/ansible_ZT35_y/ansible_module_pamd.py", line 656, in validate
    if not current_line.is_valid()[0]:
TypeError: 'bool' object is not callable

```



Discussion:
Files identified in the description:
* [lib/ansible/modules/system/pamd.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/system/pamd.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
cc @kevensen
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
Any chance of this regression not making it into the 2.6 stable release?  This works fine in versions 2.4 and 2.5.  I've tested with v2.6.0rc5, and the problem persists.

Thanks!

Resolving patch:
diff --git a/lib/ansible/modules/system/pamd.py b/lib/ansible/modules/system/pamd.py
--- a/lib/ansible/modules/system/pamd.py
+++ b/lib/ansible/modules/system/pamd.py
@@ -290,6 +290,17 @@ def __init__(self, line):
         self.prev = None
         self.next = None
 
+    @property
+    def is_valid(self):
+        if self.line == '':
+            return True
+        return False
+
+    def validate(self):
+        if not self.is_valid:
+            return False, "Rule is not valid " + self.line
+        return True, "Rule is valid " + self.line
+
     # Method to check if a rule matches the type, control and path.
     def matches(self, rule_type, rule_control, rule_path, rule_args=None):
         return False
@@ -324,7 +335,7 @@ def is_valid(self):
 class PamdRule(PamdLine):
 
     valid_types = ['account', 'auth', 'password', 'session']
-    valid_simple_controls = ['required', 'requisite', 'sufficicent', 'optional', 'include', 'substack']
+    valid_simple_controls = ['required', 'requisite', 'sufficient', 'optional', 'include', 'substack']
     valid_control_values = ['success', 'open_err', 'symbol_err', 'service_err', 'system_err', 'buf_err',
                             'perm_denied', 'auth_err', 'cred_insufficient', 'authinfo_unavail', 'user_unknown',
                             'maxtries', 'new_authtok_reqd', 'acct_expired', 'session_err', 'cred_unavail',
@@ -405,15 +416,19 @@ def is_action_unsigned_int(cls, string_num):
             return True
         return False
 
+    @property
+    def is_valid(self):
+        return self.validate()[0]
+
     def validate(self):
         # Validate the rule type
         if self.rule_type not in PamdRule.valid_types:
             return False, "Rule type, " + self.rule_type + ", is not valid in rule " + self.line
         # Validate the rule control
-        if isinstance(self.rule_control, str) and self.rule_control not in PamdRule.valid_simple_controls:
+        if isinstance(self._control, str) and self.rule_control not in PamdRule.valid_simple_controls:
             return False, "Rule control, " + self.rule_control + ", is not valid in rule " + self.line
-        elif isinstance(self.rule_control, list):
-            for control in self.rule_control:
+        elif isinstance(self._control, list):
+            for control in self._control:
                 value, action = control.split("=")
                 if value not in PamdRule.valid_control_values:
                     return False, "Rule control value, " + value + ", is not valid in rule " + self.line
@@ -653,8 +668,8 @@ def validate(self):
         current_line = self._head
 
         while current_line is not None:
-            if not current_line.is_valid()[0]:
-                return current_line.is_valid()
+            if not current_line.validate()[0]:
+                return current_line.validate()
             current_line = current_line.next
         return True, "Module is valid"
 


Test patch: