Problem: RCE by leveraging extra-vars about webui HOT 3 CLOSED

Greetings!

Should at least be mentioned in the docs, yeah.
As I see it - even allowing users to execute playbooks is by design a RCE in the context of the executing user. (when target is localhost)

from webui.

Could be nice-to-have to allow a specific runner user. So the execution context is separated from the WebUI context. (Setting in System config)

P.E. User ansible-webui is running the WebUI and ansible-runner user is executing commands
The WebUI user will need system privileges to become the runner user.

from webui.

Could be nice-to-have to allow a specific runner user. So the execution context is separated from the WebUI context. (Setting in System config)

Would be doable if ansible-runner would allow us to specify the subprocess-user (currently not possible).
I've created a feature-request in the ansible-runner repo to find out if they would be OK with adding support for it.

from webui.