Don't create world-readable module and tempfiles without explicit user permission

1 files changed, 8 insertions, 0 deletions

diff --git a/examples/ansible.cfg b/examples/ansible.cfg
index 98657cc062..19913af9aa 100644
--- a/examples/ansible.cfg
+++ b/examples/ansible.cfg
@@ -212,6 +212,14 @@
 # prevents logging of tasks, but only on the targets, data is still logged on the master/controller
 #no_target_syslog = False
 
+# controls whether Ansible will raise an error or warning if a task has no
+# choice but to create world readable temporary files to execute a module on
+# the remote machine.  This option is False by default for security.  Users may
+# turn this on to have behaviour more like Ansible prior to 2.1.x.  See
+# https://docs.ansible.com/ansible/become.html#becoming-an-unprivileged-user
+# for more secure ways to fix this than enabling this option.
+#allow_world_readable_tmpfiles = False
+
 # controls the compression level of variables sent to
 # worker processes. At the default of 0, no compression
 # is used. This value must be an integer from 0 to 9.