在 Ansible 中，如何将 Execution-Policy 设置为 RemoteSigned？

Question

我有一个执行 Powershell 脚本的 Ansible 角色。我这样做

- name: Set the execution policy to Unrestricted first
  win_shell: Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope LocalMachine -Force
  tags: always

- name: Start the services
  win_shell: C:\Users\Administrator\Desktop\Start_Services.ps1
  args:
    chdir: C:\Users\Administrator\Desktop\
  when: exa_services_state == "started"
  tags: always

- name: Stop the services
  win_shell: C:\Users\Administrator\Desktop\Stop_Services.ps1
  args:
    chdir: C:\Users\Administrator\Desktop\
  when: exa_services_state == "stopped"
  tags: always

- name: Set the execution policy to RemoteSigned
  win_shell: Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine -Force
  tags: always

但是，当最后一个任务执行时，我得到以下信息

fatal: [10.227.26.97]: FAILED! => {"changed": true, "cmd": "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine -Force", "delta": "0:00:00.640619", "end": "2022-03-04 05:33:29.496843", "msg": "non-zero return code", "rc": 1, "start": "2022-03-04 05:33:28.856224", "stderr": "Set-ExecutionPolicy : Windows PowerShell updated your execution policy successfully, but the setting is overridden by \r\na policy defined at a more specific scope.  Due to the override, your shell will retain its current effective \r\nexecution policy of Unrestricted. Type \"Get-ExecutionPolicy -List\" to view your execution policy settings. For more \r\ninformation please see \"Get-Help Set-ExecutionPolicy\".\r\nAt line:1 char:65\r\n+ ... ing $false; Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope  ...\r\n+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n    + CategoryInfo          : PermissionDenied: (:) [Set-ExecutionPolicy], SecurityException\r\n    + FullyQualifiedErrorId : ExecutionPolicyOverride,Microsoft.PowerShell.Commands.SetExecutionPolicyCommand", "stderr_lines": ["Set-ExecutionPolicy : Windows PowerShell updated your execution policy successfully, but the setting is overridden by ", "a policy defined at a more specific scope.  Due to the override, your shell will retain its current effective ", "execution policy of Unrestricted. Type \"Get-ExecutionPolicy -List\" to view your execution policy settings. For more ", "information please see \"Get-Help Set-ExecutionPolicy\".", "At line:1 char:65", "+ ... ing $false; Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope  ...", "+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~", "    + CategoryInfo          : PermissionDenied: (:) [Set-ExecutionPolicy], SecurityException", "    + FullyQualifiedErrorId : ExecutionPolicyOverride,Microsoft.PowerShell.Commands.SetExecutionPolicyCommand"], "stdout": "", "stdout_lines": []}

如果我进入节点并执行 Get-ExecutionPolicy 我看到

PS: C:\Users\myuser>Get-ExecutionPolicy -List
        Scope ExecutionPolicy
        ----- ---------------
MachinePolicy       Undefined
   UserPolicy       Undefined
      Process       Undefined
  CurrentUser       Undefined
 LocalMachine    RemoteSigned

如何避免该错误？谢谢！

Answer 1

原则上，您的命令实际上成功了（！），正如错误消息的措辞所证明的那样。

如果您只想为未来会话设置本地计算机策略，则可以通过将语句括在try忽略错误代码> / <代码>捕获;另请注意尾随的 ; exit 0 以确保退出代码 0 报告回 Ansible：

  win_shell: try { Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine -Force } catch { }; exit 0

注意：如果您确信自己正在使用海拔高度运行（这会设置机器< /em> 策略要求），一个空的 catch 块（如上所述）可能就足够了。

一个强大的解决方案需要做更多的工作：

  win_shell: try { Set-ExecutionPolicy -Scope LocalMachine allSigned -force } catch { if ($_.FullyQualifiedErrorId -ne 'ExecutionPolicyOverride,Microsoft.PowerShell.Commands.SetExecutionPolicyCommand') { throw } }; exit 0

这会选择性地忽略预期的错误，同时重新抛出任何其他错误。

---

顺便说一句：不幸的是，错误消息所描述的情况（如下所述）以错误的形式出现，更不用说作为（语句）-终止了。 GitHub 问题 #12032 中对此进行了讨论，但决定保留此行为为了向后兼容。

该消息试图告诉您的是，您的执行策略不会生效 - 在您的情况下在当前会话中 - 因为它被限制较少的策略抢占具有更高优先级的范围 - 请参阅概念性的 about_Execution_Policies 帮助主题。

不幸的是，该错误也会通过 powershell.exe 针对临时、特定于进程的覆盖（Process范围）触发。 CLI 的 -ExecutionPolicy 参数，以便如下命令触发它：

powershell -ExecutionPolicy Bypass -c Set-ExecutionPolicy -Scope CurrentUser RemoteSigned

也就是说，执行 Set-ExecutionPolicy 命令的会话具有 < em>特定于流程的执行策略Bypass 的，并且因为 Process 范围的优先级高于 CurrentUser 范围，并且因为 Bypass 策略是限制少于 RemoteSigned，则会发生错误。

从技术上讲，在该特定会话本身中，Set-ExecutionPolicy 不会生效（因为特定于进程的Bypass 会覆盖它），但它将在未来会话中（除非再次被覆盖） - 并且如果 CLI 调用的唯一目的是为未来会话设置持久执行策略，这个错误只不过是一个令人困惑的错误烦恼。

我猜您看到此错误是因为 Ansible 在处理 win_shell 命令时在幕后使用 powershell -ExecutionPolicy Bypass （或 Unrestricted）。