# Bug: ansible json cache not always invalidated when switching between non/privileged plays

**URL:** <https://forum.ansible.com/t/bug-ansible-json-cache-not-always-invalidated-when-switching-between-non-privileged-plays/26545>\
**Category:** Ansible Project\
**Created:** [January 23, 2018, 9:12pm UTC](https://forum.ansible.com/t/bug-ansible-json-cache-not-always-invalidated-when-switching-between-non-privileged-plays/26545 "2018-01-23T21:12:37Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Budding\_Mechanic](https://avatars.discourse-cdn.com/v4/letter/b/a4c791/32.png) [@Budding\_Mechanic](https://forum.ansible.com/u/Budding_Mechanic)\
**Post date:** [January 23, 2018, 9:12pm UTC](https://forum.ansible.com/t/bug-ansible-json-cache-not-always-invalidated-when-switching-between-non-privileged-plays/26545/1 "2018-01-23T21:12:37Z")

</div>

I found an issue in ansible 2.4.2.0. This may have existed in previous versions.

[defaults]  
callback\_whitelist = timer  
fact\_caching = jsonfile  
fact\_caching\_connection = ./.fact\_cache  
gathering = smart  
host\_key\_checking = False  
inventory = ./inventories  
log\_path = /tmp/ansible.${USER}.log  
roles\_path = ./roles

The issue revolves around the cache file not being invalidated when different parameters are used to fetch the facts.

In the example below, the root\_fact will not be printed and an error is raised.

- hosts: example\_host  
gather\_facts: true  
tasks:

- debug:  
msg: “user\_fact: {{ user\_fact }}”

- hosts: example\_host  
gather\_facts: true  
become: true # fetch privileged facts  
tasks:

- debug:  
msg: “root\_fact: {{ root\_fact }}”

The reason is the first play fetched the facts and primed the cache with non-privileged results. Subsequent privileged fact lookups will use the cache file, but the privileged facts aren’t in the cache.

I consider this a bug.

And the inverse is also true; if privileged facts are obtained first then subsequent plays will use the cache results and those subsequent plays will have access to privileged facts. In the example below, “root\_fact\_nonpriv” will be printed.

- hosts: example\_host

gather\_facts: true  
become: true # fetch privileged facts  
tasks:

- debug:  
msg: “root\_fact: {{ root\_fact }}”

- hosts: example\_host  
gather\_facts: true  
tasks:

- debug:  
msg: “root\_fact\_nonpriv: {{ root\_fact }}”

I don’t know whether I consider this a security bug, but it smells.

In both cases, subtle bugs can be introduced that can be hard to track down.

It seems to me the cache file needs to store the conditions in which it was retrieved. A simple approach would be appending ‘privileged’ to the cache file and using the appropriate cache file based on whether ‘become=true’ is set. Example:

.fact\_cache/example\_host # non-privileged facts  
.fact\_cache/example\_host.privileged # privileged facts

In summary, a fact cache file obviously needs to continue to check whether it’s stale or not by comparing age of the file to the cache timeout.

In addition, I would argue that ansible also needs to know whether the cache file is privileged or not when considering whether it’s stale or not.

BTW, using meta: clear\_facts is a workaround not really a solution.

Thoughts?