[PR #12090/9bb7aee8 backport][stable-13] composer: warn when running as root - #12722
Merged
felixfontein merged 1 commit intoSep 13, 2026
Conversation
* feat(composer): warn when running as root Fixes #2388 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(changelog): add fragment for PR 12090 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(test_composer): update expected working-dir command format The composer_as_root test case still expected the pre-rebase command format (working-dir as a separate trailing option) instead of the current --working-dir=<path> token placed before the subcommand. * reformat * fix(composer): relay composer's own root/super-user warning instead of reimplementing it Per review feedback, stop independently deciding when running as root is unsafe (which is wrong in cases like official containers) and instead surface composer's own warning as an Ansible warning. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(test_composer): make root-warning assertion resilient across ansible-core versions CI on ansible-core 2.18 failed: module.warn() serializes warnings as plain strings there, but as structured WarningSummary/Event dicts on 2.19+. Assert via substring match instead of exact equality so the test passes on both. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> (cherry picked from commit 9bb7aee)
Collaborator
ansibullbot
added
backport
feature
felixfontein
deleted the
patchback/backports/stable-13/9bb7aee82639bf5f569d8cde375f87223c52ac72/pr-12090
branch
September 13, 2026 14:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a backport of PR #12090 as merged into main (9bb7aee).
SUMMARY
When the
community.general.composermodule runs as root, composer itself emits a security warning that is currently silently swallowed. This PR adds amodule.warn()call when the effective UID is 0, so operators are made aware of the issue. TheCOMPOSER_ALLOW_SUPERUSERenvironment variable is documented in the module notes as the upstream escape hatch.Fixes #2388
ISSUE TYPE
COMPONENT NAME
composer
ADDITIONAL INFORMATION
N/A