# bad PATH when running "apt" module **URL:** \ **Category:** Ansible Project\ **Created:** [May 4, 2015, 1:37am UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152 "2015-05-04T01:37:07Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Alex\_Peters](https://avatars.discourse-cdn.com/v4/letter/a/cdc98d/32.png) [@Alex\_Peters](https://forum.ansible.com/u/Alex_Peters)\ **Post date:** [May 4, 2015, 1:37am UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/1 "2015-05-04T01:37:07Z")
I’m trying to install a package on a system running a Debian Jessie-based distribution called [OSMC](https://osmc.tv/). This task (run with ansible\_sudo == true): > - name: ensure Vim is installed > > apt: name=vim state=present causes this to happen: > TASK: [vim | ensure Vim is installed] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > > failed: [XXX] =\> {“failed”: true} > > stderr: E: Sub-process /usr/bin/dpkg returned an error code (2) > > stdout: Reading package lists… > > … > > dpkg: warning: ‘ldconfig’ not found in PATH or not executable > > dpkg: warning: ‘start-stop-daemon’ not found in PATH or not executable > > dpkg: error: 2 expected programs not found in PATH or not executable > > Note: root’s PATH should usually contain /usr/local/sbin, /usr/sbin and /sbin > > msg: ‘/usr/bin/apt-get -y -o “Dpkg::Options::=–force-confdef” -o “Dpkg::Options::=–force-confold” install ‘vim’’ failed: E: Sub-process /usr/bin/dpkg returned an error code (2) It seems that something is mangling the PATH before apt-get is called, because if I SSH manually into this system: > $ which ldconfig start-stop-daemon > > /sbin/ldconfig > > /sbin/start-stop-daemon > > $ echo $PATH > > /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/sbin:/usr/sbin:/opt/vc/bin > > $ sudo sh -c ‘echo $PATH’ > > /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/sbin:/usr/sbin:/opt/vc/bin the PATH is correct and I have no problem installing the package manually. What can I do to improve this situation? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [May 4, 2015, 3:21pm UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/2 "2015-05-04T15:21:14Z")
When you gather facts on the machine, you should be able to see the 'PATH' that ansible sees under ansible\_env, ansible uses it's own path list to find apt and dpkg, but that should not influence the other tools, which ansible is not using directly. ---
**Author:** ![Alex\_Peters](https://avatars.discourse-cdn.com/v4/letter/a/cdc98d/32.png) [@Alex\_Peters](https://forum.ansible.com/u/Alex_Peters)\ **Post date:** [May 8, 2015, 1:35am UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/3 "2015-05-08T01:35:41Z")
> When you gather facts on the machine, you should be able to see the > ‘PATH’ that ansible sees under ansible\_env, ansible uses it’s own path > list to find apt and dpkg, but that should not influence the other > tools, which ansible is not using directly. Thanks for your response. If I understand you correctly, I can also do this to see what PATH Ansible is using: > $ ansible -m setup XXX > … > > XXX | success \>\> { > > “ansible\_facts”: { > > … > > “ansible\_env”: { > > … > > “PATH”: “/usr/local/bin:/usr/bin:/bin:/usr/games”, > > … > > “USERNAME”: “root” > > }, > > … > > }, > > “changed”: false > > } The USERNAME of “root” tells me that Ansible is correctly sudo-ing before running the setup, so I’d expect it to be doing the same before apt-ing. If this is the PATH setting when Ansible runs apt-get though, it’s no surprise to me that it’s failing when it tries to hit things in /sbin. What could be responsible for this discrepancy in the PATHs based on how the system is being accessed? Is this likely to be a system configuration issue or an Ansible (v1.9.1) issue? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [May 8, 2015, 1:27pm UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/4 "2015-05-08T13:27:07Z")
The first one I would look at is sudo (/etc/sudoers), as it normally resets all env variables for a user. ---
**Author:** ![Alex\_Peters](https://avatars.discourse-cdn.com/v4/letter/a/cdc98d/32.png) [@Alex\_Peters](https://forum.ansible.com/u/Alex_Peters)\ **Post date:** [May 8, 2015, 1:37pm UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/5 "2015-05-08T13:37:18Z")
> The first one I would look at is sudo (/etc/sudoers), as it normally > resets all env variables for a user. The contents of my /etc/sudoers and /etc/sudoers.d/\* files are: > Defaults env\_reset > > Defaults mail\_badpass > > Defaults secure\_path=“/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin” > > root ALL=(ALL:ALL) ALL > > %sudo ALL=(ALL:ALL) ALL > > Defaults env\_keep += “RPI\_UPDATE\_UNSUPPORTED” > > Defaults !secure\_path I can’t really see an issue there, but I’m not very experienced with these files. I note though that if I SSH into this machine manually, the PATHs are still okay: > $ echo $PATH > > /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/sbin:/usr/sbin:/opt/vc/bin > > $ sudo su > > # echo $PATH > > /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin that is, they still have /sbin in them both before and after sudo-ing… Is my sudo setup still a possible culprit? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [May 8, 2015, 1:55pm UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/6 "2015-05-08T13:55:29Z")
try: sudo sh -c 'echo $PATH' su can readd path info, the above is closer to what ansible does (it uses sudo -u \ not sudo su). ---
**Author:** ![Alex\_Peters](https://avatars.discourse-cdn.com/v4/letter/a/cdc98d/32.png) [@Alex\_Peters](https://forum.ansible.com/u/Alex_Peters)\ **Post date:** [May 8, 2015, 2:33pm UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/7 "2015-05-08T14:33:40Z")
$ sudo sh -c ‘echo $PATH’ /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/sbin:/usr/sbin:/opt/vc/bin ---
**Author:** ![Alex\_Peters](https://avatars.discourse-cdn.com/v4/letter/a/cdc98d/32.png) [@Alex\_Peters](https://forum.ansible.com/u/Alex_Peters)\ **Post date:** [May 9, 2015, 12:18pm UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/8 "2015-05-09T12:18:36Z")
> try: sudo sh -c ‘echo $PATH’ > > su can readd path info, the above is closer to what ansible does (it > uses sudo -u not sudo su). Done: > $ sudo sh -c ‘echo $PATH’ > /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/sbin:/usr/sbin:/opt/vc/bin Does this rule out problems with my sudo setup? Any other ideas? ---
**Author:** ![Alex\_Peters](https://avatars.discourse-cdn.com/v4/letter/a/cdc98d/32.png) [@Alex\_Peters](https://forum.ansible.com/u/Alex_Peters)\ **Post date:** [May 11, 2015, 11:48am UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/9 "2015-05-11T11:48:30Z")
I’ve been unable to resolve this issue with the ideas presented so far. In the absence of any further responses, should I consider this an Ansible bug and file a bug report? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [May 11, 2015, 1:53pm UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/10 "2015-05-11T13:53:14Z")
i'm unable to reproduce the issue, the path seems fine, not sure if its a bug or not, but without a way to reproduce the issue I'm not sure how it will get resolved. ---
**Author:** ![Marcus\_Franke](https://avatars.discourse-cdn.com/v4/letter/m/cdc98d/32.png) [@Marcus\_Franke](https://forum.ansible.com/u/Marcus_Franke)\ **Post date:** [May 11, 2015, 2:29pm UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/11 "2015-05-11T14:29:39Z")
Hi Alex, if you are looking for problems with sudo you can login as your ansible user and issue “sudo -l”. This will list all commands your ansible user is allowed to use. From your sudo config files, %sudo group can fire all kind of commands, but needs a password. That’s by intention? Regards, Marcus ---
**Author:** ![Alex\_Peters](https://avatars.discourse-cdn.com/v4/letter/a/cdc98d/32.png) [@Alex\_Peters](https://forum.ansible.com/u/Alex_Peters)\ **Post date:** [May 11, 2015, 11:22pm UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/12 "2015-05-11T23:22:30Z")
Would giving you SSH access to this particular machine be useful? ---
**Author:** ![Alex\_Peters](https://avatars.discourse-cdn.com/v4/letter/a/cdc98d/32.png) [@Alex\_Peters](https://forum.ansible.com/u/Alex_Peters)\ **Post date:** [May 12, 2015, 10:47am UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/13 "2015-05-12T10:47:46Z")
> if you are looking for problems with sudo you can login as your ansible user and issue “sudo -l”. This will list all commands your ansible user is allowed to use. The output of this command on the affected machine is as follows: > $ sudo -l > Matching Defaults entries for osmc on osmc: > env\_reset, mail\_badpass, secure\_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin, env\_keep+=RPI\_UPDATE\_UNSUPPORTED, !secure\_path > > User osmc may run the following commands on osmc: > (root) NOPASSWD: ALL To me, this indicates that after running sudo, the PATH should still contain /sbin. My problems with Ansible’s apt module seem to strongly indicate that this is only not the case when Ansible is involved. Although I appreciate that this is not easy to replicate on another machine, I still feel that on the current balance of probabilities, this indicates an Ansible bug. I’m happy to provide Ansible developers with SSH access to this particular machine for further diagnosis if it’s not possible to suggest any other solutions at this time. > From your sudo config files, %sudo group can fire all kind of commands, but needs a password. That’s by intention? This is a largely pre-configured system based off another distribution, so it wouldn’t surprise me if this definition is an unintended remnant from the base distribution. The Ansible user is not part of the sudo group. so I don’t believe it should have any effect. ---
**Author:** ![Alex\_Peters](https://avatars.discourse-cdn.com/v4/letter/a/cdc98d/32.png) [@Alex\_Peters](https://forum.ansible.com/u/Alex_Peters)\ **Post date:** [May 14, 2015, 12:17am UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/14 "2015-05-14T00:17:36Z")
I hate bumping my own posts without contributing any more information, but I’m totally stuck on this issue and I can’t progress without assistance. Can someone please provide me with some more direction towards resolving this problem? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [May 14, 2015, 12:18am UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/15 "2015-05-14T00:18:36Z")
sorry to say, I'm stumped here, i have not been able to reproduce your issue and really don't understand how it can happen with the information given. ---
**Author:** ![Alex\_Peters](https://avatars.discourse-cdn.com/v4/letter/a/cdc98d/32.png) [@Alex\_Peters](https://forum.ansible.com/u/Alex_Peters)\ **Post date:** [May 14, 2015, 12:27pm UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/16 "2015-05-14T12:27:28Z")
I tried running this very verbose command: > ansible -vvv -m setup XXX which caused the following to be output (among other things): > EXEC sshpass -d6 ssh -C -tt -v -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=“…/.ansible/cp/ansible-ssh-%h-%p-%r” -o GSSAPIAuthentication=no -o PubkeyAuthentication=no -o User=osmc -o ConnectTimeout=10 XXX /bin/sh -c ‘sudo -k && sudo -H -S -p “[sudo via ansible, key=xidpkckjjfdcsgiewleebdlstyiyzpad] password: " -u root /bin/sh -c '”’“‘echo BECOME-SUCCESS-xidpkckjjfdcsgiewleebdlstyiyzpad; LANG=C LC\_CTYPE=C /usr/bin/python /home/osmc/.ansible/tmp/ansible-tmp-1431605612.35-230680545785241/setup; rm -rf /home/osmc/.ansible/tmp/ansible-tmp-1431605612.35-230680545785241/ \>/dev/null 2\>&1’”‘"’’ which prompted me to cut out Ansible altogether and just try this: > $ ssh osmc@XXX /bin/sh -c ‘“echo $PATH”’ > OSMC: Open Source Media Center > osmc@XXX’s password: > /usr/local/bin:/usr/bin:/bin:/usr/games > $ ssh osmc@XXX /usr/bin/sudo -u root /bin/sh -c ‘“echo $PATH”’ > OSMC: Open Source Media Center > osmc@XXX’s password: > /usr/local/bin:/usr/bin:/bin:/usr/games which is a very different PATH to when I log in interactively: > $ ssh osmc@XXX > OSMC: Open Source Media Center > osmc@XXX’s password: > osmc@XXX:~$ echo $PATH > /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/sbin:/usr/sbin:/opt/vc/bin > osmc@XXX:~$ sudo echo $PATH > /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/sbin:/usr/sbin:/opt/vc/bin So on the bright side, it doesn’t seem to be an Ansible problem after all, which means it’s probably out of scope for this discussion group. Time to read up on the differences between interactive, non-interactive, login and non-login bashsessions, it seems… Thanks anyway for all of your attention to this point. I’m sorry to have wasted your time. ---
**Author:** ![Alastair\_Brayne](https://avatars.discourse-cdn.com/v4/letter/a/a587f6/32.png) [@Alastair\_Brayne](https://forum.ansible.com/u/Alastair_Brayne)\ **Post date:** [October 6, 2015, 7:43pm UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/17 "2015-10-06T19:43:24Z")
Did you find a solution to this by any chance? I’ve got exactly the same problem and am beginning to get mighty pissed at the amount of useless yak-shaving that isn’t even working. No matter what I try, it looks like the secure\_path in the sudoers file is ignored somewhere down the call stack. I did find this reference: [https://wiki.debian.org/sudo#PATH\_not\_set](https://wiki.debian.org/sudo#PATH_not_set). But, I don’t seem to have any other sudoers file and this isn’t an upgrade. Completely stumped and reaching the end of my patience with this (been at this one issue for literally a week now) Any help HUGELY appreciated Thanks Alastair ---
**Author:** ![Ralph](https://avatars.discourse-cdn.com/v4/letter/r/f475e1/32.png) [@Ralph](https://forum.ansible.com/u/Ralph)\ **Post date:** [October 7, 2015, 5:45pm UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/18 "2015-10-07T17:45:09Z")
Hi there, something like this might work just fine… - name: upgrade all installed packages apt: update\_cache=yes upgrade=yes environment: PATH: /bin:/sbin:/usr/bin:/usr/sbin Cheers Ralph ---
**Author:** ![Markus\_Ellers](https://avatars.discourse-cdn.com/v4/letter/m/35a633/32.png) [@Markus\_Ellers](https://forum.ansible.com/u/Markus_Ellers)\ **Post date:** [October 7, 2015, 5:48pm UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/19 "2015-10-07T17:48:08Z")
I put in this task to make sure secure\_path is used. It is now part of my “set the node up for use with ansible” playbook: - name: Special for osmc. Make sure secure\_path is honored file: path=/etc/sudoers.d/osmc-no-secure-path state=absent There is a discussion on this in the osmc forum where one of the developers says this is not something they support officially but there shouldn’t be any issues and so far I haven’t had any. (I had this already set up before the last major osmc Update) [https://discourse.osmc.tv/t/system-path-broken-when-running-a-non-interactive-sudo-command/4167/6](https://discourse.osmc.tv/t/system-path-broken-when-running-a-non-interactive-sudo-command/4167/6) There is also another workaround in the thread where the PATH env is set as part of the task ---
**Author:** ![Markus\_Ellers](https://avatars.discourse-cdn.com/v4/letter/m/35a633/32.png) [@Markus\_Ellers](https://forum.ansible.com/u/Markus_Ellers)\ **Post date:** [October 7, 2015, 5:53pm UTC](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152/20 "2015-10-07T17:53:44Z")
I have this as part of my “set node up for ansible” playbook. - name: Special for osmc. Make sure secure\_path is honored file: path=/etc/sudoers.d/osmc-no-secure-path state=absent For more info look here: [https://discourse.osmc.tv/t/system-path-broken-when-running-a-non-interactive-sudo-command/4167/6](https://discourse.osmc.tv/t/system-path-broken-when-running-a-non-interactive-sudo-command/4167/6) Worked for me so far and I don’t have to set env vars during apt tasks (useful because I don’t want to alter my site-yml playbook for just the osmc node). [Next page](https://forum.ansible.com/t/bad-path-when-running-apt-module/18152.md?page=2)