# Can I provide .pyo files as module\_path library

**URL:** <https://forum.ansible.com/t/can-i-provide-pyo-files-as-module-path-library/23733>\
**Category:** Ansible Project\
**Created:** [February 15, 2017, 2:49am UTC](https://forum.ansible.com/t/can-i-provide-pyo-files-as-module-path-library/23733 "2017-02-15T02:49:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Poojitha\_A](https://avatars.discourse-cdn.com/v4/letter/p/b9bd4f/32.png) [@Poojitha\_A](https://forum.ansible.com/u/Poojitha_A)\
**Post date:** [February 15, 2017, 2:49am UTC](https://forum.ansible.com/t/can-i-provide-pyo-files-as-module-path-library/23733/1 "2017-02-15T02:49:30Z")

</div>

Hi Guys.

currently we are shipping our code as .pyo to ensure a minimal security to our python code base. I wanted to know if passing the module\_path=‘library\_path’ where the library path has

.pyo files instead of .py files work, since I was getting an error saying module not found.

Can someone please comment on this?

Thanks  
Poojithaa

---

<div class="post-metadata">

**Author:** ![Matt\_Clay](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@Matt\_Clay](https://forum.ansible.com/u/Matt_Clay)\
**Post date:** [February 15, 2017, 8:27pm UTC](https://forum.ansible.com/t/can-i-provide-pyo-files-as-module-path-library/23733/2 "2017-02-15T20:27:03Z")

</div>

Poojithaa,

You’re probably encountering the error here: [https://github.com/ansible/ansible/blob/devel/lib/ansible/executor/module\_common.py#L512](https://github.com/ansible/ansible/blob/devel/lib/ansible/executor/module_common.py#L512)

Due to possible version differences between the python version used to compile the module and the python version on the remote system which will execute the module, modules must be available as source.

- Matt

---

<div class="post-metadata">

**Author:** ![Poojitha\_A](https://avatars.discourse-cdn.com/v4/letter/p/b9bd4f/32.png) [@Poojitha\_A](https://forum.ansible.com/u/Poojitha_A)\
**Post date:** [February 16, 2017, 12:24am UTC](https://forum.ansible.com/t/can-i-provide-pyo-files-as-module-path-library/23733/3 "2017-02-16T00:24:11Z")

</div>

Hi Matt,

Could be the case however, we are running all the files locally. It should be using the same compiler that we used to build .pyo files.

---

<div class="post-metadata">

**Author:** ![Toshio\_Kuratomi](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@Toshio\_Kuratomi](https://forum.ansible.com/u/Toshio_Kuratomi)\
**Post date:** [February 16, 2017, 1:10am UTC](https://forum.ansible.com/t/can-i-provide-pyo-files-as-module-path-library/23733/4 "2017-02-16T01:10:11Z")

</div>

Ansible is not designed to handle this case. There’s too many things that become impossible. I can think of a work around, though.

The workaround is to make your modules into a binary modue. Something like cx\_freeze will create a single file executable with all of the things necessary to execute the code ( I’d recommend looking at this page, picking a tool that might do what you need and then reading that tool’s documetation for more information: [http://docs.python-guide.org/en/latest/shipping/freezing/](http://docs.python-guide.org/en/latest/shipping/freezing/) ) The single file executable can then be used by ansible as a binary module (one that can be executed directly from the shell on the remote machine) rather than having to try pushing it through an interpreter.

As for some of the reasons Ansible cannot support directly executing a byte compiled file:

- We can’t scan .pyos or .pycs to determine what module\_utils files need to be included when we send the module over the wire.
- byte compiled files aren’t directly executable so they need to be run by an interpreter. But the byte compiled file doesn’t have a shebang line so we can’t detect what interpreter to use.
- byte compiled files are restricted to the python major version so we can’t know whether they’ll actually run on the remote machine’s python
- .pycs and .pyos don’t actually provide any security… at best they’re a mild, reversible obfuscation. Someone who’s taken the trouble to acquire the byte compiled files can easily reverse them to find out what’s going on.

-Toshio

---

<div class="post-metadata">

**Author:** ![Matt\_Clay](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@Matt\_Clay](https://forum.ansible.com/u/Matt_Clay)\
**Post date:** [February 16, 2017, 1:27am UTC](https://forum.ansible.com/t/can-i-provide-pyo-files-as-module-path-library/23733/5 "2017-02-16T01:27:58Z")

</div>

Since python bytecode can be easily converted back to python source, there isn’t any security there.

That aside, and I don’t recommend this, you could create a python stub loader which loaded embedded python bytecode. Here’s a quick proof of concept (again, I don’t recommend this):

#!/usr/bin/python

import base64  
import marshal

# with open(‘module.pyc’) as fd:

# bytecode = base64.b64encode(fd.read()[8:])

bytecode = ‘INSERT YOUR BYTECODE HERE, SEE COMMENT ABOVE’

exec marshal.loads(base64.b64decode(bytecode))

- Matt