Repository: ansible/ansible

Issue:
Set file permissions for openssl_publickey to 0600?
<!---
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release, and master branch are affected too.
-->

##### ISSUE TYPE
<!--- Pick one below and delete the rest: -->
 - Bug Report

##### COMPONENT NAME
<!--- Name of the module/plugin/task/feature -->
openssl_privatekey and openssl_publickey

##### ANSIBLE VERSION
<!--- Paste verbatim output from “ansible --version” between quotes below -->
```
ansible 2.3.0.0
  config file = /Users/.../ansible.cfg
  configured module search path = [u'./ansible/library']
  python version = 2.7.13 (default, Dec 17 2016, 23:03:43) [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.42.1)]
```

##### CONFIGURATION
<!---
Mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).
-->

##### OS / ENVIRONMENT
<!---
Mention the OS you are running Ansible from, and the OS you are
managing, or say “N/A” for anything that is not platform-specific.
-->
MacOS X 10.11.6

##### SUMMARY
<!--- Explain the problem briefly -->

openssl_publickey creates a file with permissions 0644, but it appears that they are generally stored as 0600.

I'm a bit iffy on this because I can't find a clear reference that the **public** key should be stored as 0600 as opposed to say 0644, but on Mac OS X it appears to be the default.



Discussion:

Resolving patch:
diff --git a/lib/ansible/modules/crypto/openssl_csr.py b/lib/ansible/modules/crypto/openssl_csr.py
--- a/lib/ansible/modules/crypto/openssl_csr.py
+++ b/lib/ansible/modules/crypto/openssl_csr.py
@@ -31,7 +31,7 @@
     - "This module allows one to (re)generates OpenSSL certificate signing requests.
        It uses the pyOpenSSL python library to interact with openssl. This module support
        the subjectAltName extension. Note: At least one of commonName or subjectAltName must
-       be specified."
+       be specified. This module uses file common arguments to specify generated file permissions."
 requirements:
     - "python-pyOpenSSL"
 options:
diff --git a/lib/ansible/modules/crypto/openssl_privatekey.py b/lib/ansible/modules/crypto/openssl_privatekey.py
--- a/lib/ansible/modules/crypto/openssl_privatekey.py
+++ b/lib/ansible/modules/crypto/openssl_privatekey.py
@@ -30,7 +30,8 @@
 description:
     - "This module allows one to (re)generate OpenSSL private keys. It uses
        the pyOpenSSL python library to interact with openssl. One can generate
-       either RSA or DSA private keys. Keys are generated in PEM format."
+       either RSA or DSA private keys. Keys are generated in PEM format.
+       This module uses file common arguments to specify generated file permissions."
 requirements:
     - "python-pyOpenSSL"
 options:
diff --git a/lib/ansible/modules/crypto/openssl_publickey.py b/lib/ansible/modules/crypto/openssl_publickey.py
--- a/lib/ansible/modules/crypto/openssl_publickey.py
+++ b/lib/ansible/modules/crypto/openssl_publickey.py
@@ -30,7 +30,8 @@
 description:
     - "This module allows one to (re)generate OpenSSL public keys from their private keys.
        It uses the pyOpenSSL python library to interact with openssl. Keys are generated
-       in PEM format. This module works only if the version of PyOpenSSL is recent enough (> 16.0.0)"
+       in PEM format. This module works only if the version of PyOpenSSL is recent enough (> 16.0.0).
+       This module uses file common arguments to specify generated file permissions."
 requirements:
     - "python-pyOpenSSL"
 options:
@@ -145,6 +146,10 @@ def generate(self, module):
                 publickey_file = open(self.path, 'w')
                 publickey_file.write(publickey_content)
                 publickey_file.close()
+
+                file_args = module.load_file_common_arguments(module.params)
+                if module.set_fs_attributes_if_different(file_args, False):
+                    self.changed = True
             except (IOError, OSError) as exc:
                 raise PublicKeyError(exc)
             except AttributeError as exc:


Test patch: