# Ansible "file" module and attributes in 2.3.1.0

**URL:** <https://forum.ansible.com/t/ansible-file-module-and-attributes-in-2-3-1-0/25046>\
**Category:** Ansible Project\
**Tags:** rhel\
**Created:** [July 21, 2017, 3:34pm UTC](https://forum.ansible.com/t/ansible-file-module-and-attributes-in-2-3-1-0/25046 "2017-07-21T15:34:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dan\_linder](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dan_linder/32/3833_2.png) [@dan\_linder](https://forum.ansible.com/u/dan_linder)\
**Post date:** [July 21, 2017, 3:34pm UTC](https://forum.ansible.com/t/ansible-file-module-and-attributes-in-2-3-1-0/25046/1 "2017-07-21T15:34:43Z")

</div>

I’ve got a set of systems that have a configuration file with the “immutable” flag set on them by a previous setup process. The “lsattr /etc/security/access.conf” on a RHEL 6 system shows the “i” flag set. Manually doing a “chattr -i /etc/security/access.conf” removes the flag, but I’d like to have Ansible remove this flag if found on a few of these files.

I setup a playbook with this play:

> `
> 
> - name: “Remove immutable flag”  
> file:  
> path: /etc/security/access.conf  
> attributes: “-i”  
> `

The documentation isn’t clear on what “attributes” can be but the file module call chattr with the “=” precursor before the attributes. For my case, I can just send “e” as the attribute (which effectively removes “i”, the only attribute on this file usually), but it doesn’t make it easy to enforce a single change without knowing and setting all attributes. (Admittedly that would be more idempotent.)

Can someone update the the documentation, to add this note on the usage?

Or, can the command line fed to chattr be updated to remove the “=” before the attributes when a +/- is present in the attributes line? That makes it easy to use “-i” to remove immutable, or “+i” to add immutable flag, though I haven’t thought through the ramifications and idempotent features…

Thanks,

Dan

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [July 22, 2017, 2:34pm UTC](https://forum.ansible.com/t/ansible-file-module-and-attributes-in-2-3-1-0/25046/2 "2017-07-22T14:34:52Z")

</div>

> I setup a playbook with this play:
> 
> - name: "Remove immutable flag"  
> &nbsp;&nbsp;file:  
> &nbsp;&nbsp;&nbsp;&nbsp;path: /etc/security/access.conf  
> &nbsp;&nbsp;&nbsp;&nbsp;attributes: "-i"
> 
> The documentation isn't clear on what "attributes" can be but the file  
> module call chattr with the "=" precursor before the attributes. For my  
> case, I can just send "e" as the attribute (which effectively removes "i",  
> the only attribute on this file usually), but it doesn't make it easy to  
> enforce a single change without knowing and setting all attributes.  
> (Admittedly that would be more idempotent.)

It only require an additional task to only remove the attribute without touching the other ones.

&nbsp;&nbsp;&nbsp;- stat:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;path: /etc/security/access.conf  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;register: result

&nbsp;&nbsp;&nbsp;- file:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;path: /etc/security/access.conf  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;attr: '{{ result.stat.attr\_flags | regex\_replace('i', '') }}

> Can someone update the the documentation, to add this note on the usage?
> 
> Or, can the command line fed to chattr be updated to remove the "=" before  
> the attributes when a +/- is present in the attributes line? That makes it  
> easy to use "-i" to remove immutable, or "+i" to add immutable flag, though  
> I haven't thought through the ramifications and idempotent features...

You can always make a feature request on Github  
[https://github.com/ansible/ansible/issues](https://github.com/ansible/ansible/issues)

---

<div class="post-metadata">

**Author:** ![dan\_linder](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dan_linder/32/3833_2.png) [@dan\_linder](https://forum.ansible.com/u/dan_linder)\
**Post date:** [July 23, 2017, 4:26pm UTC](https://forum.ansible.com/t/ansible-file-module-and-attributes-in-2-3-1-0/25046/3 "2017-07-23T16:26:08Z")

</div>

Thanks Kai, hadn’t thought about using the attr\_flags field - I’ll give it a shot when I get back to that issue.

Dan