Control: severity -1 grave Hi
Sorry for the back and forth in severity. Actually I noticed that https://sources.debian.net/src/ansible/2.0.1.0-1/lib/ansible/modules/extras/cloud/lxc/lxc_container.py/#L532 makes the file then world-writable (see following commit which addresses that). If a local user can write to it before the script is executed we have the arbitrary code execution as root. There are now a partial fix https://github.com/ansible/ansible-modules-extras/commit/da84e2e9b83be6ebebbfd3be6776f391622c02fe and more in pull request at https://github.com/ansible/ansible-modules-extras/pull/1941 Regards, Salvatore
