# copy fails for group ownership **URL:** \ **Category:** Ansible Project\ **Created:** [September 8, 2014, 11:50am UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145 "2014-09-08T11:50:42Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Stein\_Inge\_Morisbak](https://avatars.discourse-cdn.com/v4/letter/s/d2c977/32.png) [@Stein\_Inge\_Morisbak](https://forum.ansible.com/u/Stein_Inge_Morisbak)\ **Post date:** [September 8, 2014, 11:50am UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/1 "2014-09-08T11:50:42Z")
I am trying to run the following task: - name: copy httpd.conf to /etc/httpd/conf folder copy: src=httpd.conf dest=“/etc/httpd/conf” Ownership on the server is: drwxrwsr-x 2 root developers 4096 Sep 8 13:33 . drwxrwsr-x 5 root developers 4096 Sep 4 17:51 … -rw-rw-r-- 1 root developers 34744 Apr 3 16:01 httpd.conf I am a member of the developers group. The directory and file has write permission for the developers group. However the task fails with this error message: fatal: [my-box] =\> failed to parse: {“msg”: “Could not replace file: /home/steinim/.ansible/tmp/ansible-tmp-1410176741.01-248154513611723/source to /etc/httpd/conf/httpd.conf: [Errno 1] Operation not permitted: ‘/etc/httpd/conf/.ansible\_tmpZ7a3MQhttpd.conf’”, “failed”: true} Am I missing something, or should this work? ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 8, 2014, 9:35pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/2 "2014-09-08T21:35:58Z")
Can you please share the ansible --version as well as the command line invocation you are using and the stanza of your playbook? Sounds like you are doing something non-sudo most likely, or non root, that doesn’t have enough permissions. ---
**Author:** ![Stein\_Inge\_Morisbak](https://avatars.discourse-cdn.com/v4/letter/s/d2c977/32.png) [@Stein\_Inge\_Morisbak](https://forum.ansible.com/u/Stein_Inge_Morisbak)\ **Post date:** [September 8, 2014, 9:51pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/3 "2014-09-08T21:51:12Z")
Yup. It is non-sudo and non-root. $ ansible --version ansible 1.7.1 stanza: ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 9, 2014, 3:45pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/4 "2014-09-09T15:45:52Z")
Can you show more of the playbook in context? I’m missing task names and such and wanted to be clear about something. I may have some other questions after that. ---
**Author:** ![Abubakr-Sadik\_Nii\_Na](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Abubakr-Sadik\_Nii\_Na](https://forum.ansible.com/u/Abubakr-Sadik_Nii_Na)\ **Post date:** [September 9, 2014, 4:16pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/5 "2014-09-09T16:16:36Z")
Hello Stein, which distro are you running? I usually run into this permission issues with SELINUX on CentOS. ---
**Author:** ![Stein\_Inge\_Morisbak](https://avatars.discourse-cdn.com/v4/letter/s/d2c977/32.png) [@Stein\_Inge\_Morisbak](https://forum.ansible.com/u/Stein_Inge_Morisbak)\ **Post date:** [September 9, 2014, 4:21pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/6 "2014-09-09T16:21:35Z")
I have attached the whole shebang to reproduce it. Requirements is: - the same username on the server set up with an authorized key and belonging to a group. - A file: /etc/httpd/conf/httpd.conf owned by a different user, but writable for the group the first user belongs to. > **(attachments)** > > [reproduced.tgz](https://forum.ansible.com/uploads/short-url/tNaXY5tZNlOLIKaMhGHQtM5WU0t.tgz) (12.3 KB) ---
**Author:** ![Stein\_Inge\_Morisbak](https://avatars.discourse-cdn.com/v4/letter/s/d2c977/32.png) [@Stein\_Inge\_Morisbak](https://forum.ansible.com/u/Stein_Inge_Morisbak)\ **Post date:** [September 9, 2014, 4:23pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/7 "2014-09-09T16:23:43Z")
$ sestatus SELinux status: disabled $ cat /etc/redhat-release Red Hat Enterprise Linux Server release 6.5 (Santiago) ---
**Author:** ![Abubakr-Sadik\_Nii\_Na](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Abubakr-Sadik\_Nii\_Na](https://forum.ansible.com/u/Abubakr-Sadik_Nii_Na)\ **Post date:** [September 9, 2014, 4:54pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/8 "2014-09-09T16:54:15Z")
Your attachment does not include the httpd role. Mind sharing it? I have setup what I feel is similar to your playbook and run it successfully. I think sharing the httpd role may help in reproducing your problem. ---
**Author:** ![Stein\_Inge\_Morisbak](https://avatars.discourse-cdn.com/v4/letter/s/d2c977/32.png) [@Stein\_Inge\_Morisbak](https://forum.ansible.com/u/Stein_Inge_Morisbak)\ **Post date:** [September 9, 2014, 5:01pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/9 "2014-09-09T17:01:45Z")
Og. Sorry. - copy: src=httpd.conf dest=“/etc/httpd/conf” 1. sep. 2014 18:54 skrev “Abubakr-Sadik Nii Nai Davis” \<[dwa2pac@gmail.com](mailto:dwa2pac@gmail.com)\> følgende: ---
**Author:** ![Abubakr-Sadik\_Nii\_Na](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Abubakr-Sadik\_Nii\_Na](https://forum.ansible.com/u/Abubakr-Sadik_Nii_Na)\ **Post date:** [September 9, 2014, 5:21pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/10 "2014-09-09T17:21:42Z")
Can you please tar up the httpd role as you have it and attach it to a reply? ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 9, 2014, 7:12pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/11 "2014-09-09T19:12:44Z")
> Hello Stein, which distro are you running? I usually run into this > permission issues with SELINUX on CentOS. Shouldn't be related and I want to discourage casting such impressions of SELinux 🙂 SELinux is pretty darn easy to manage. Filesystem permissions rarely occur for basic copying, but there are occasions where applications need specific handling if constrained, which can cause frustrations on development This does not apply to Ansible though, since it's not really serving anything up - so no Ansible specific SELinux config is required in nearly any case. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 9, 2014, 7:13pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/12 "2014-09-09T19:13:46Z")
As a general rule, I don’t crack open tarballs attached to the list - and I would request that since there are thousands of users on this list we don’t start using it for attachments. (I’m not sure I can turn it off). A gist or github repo would be welcome, or even pastebin for smaller things. In many cases, it can just be shown inline. ---
**Author:** ![Abubakr-Sadik\_Nii\_Na](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@Abubakr-Sadik\_Nii\_Na](https://forum.ansible.com/u/Abubakr-Sadik_Nii_Na)\ **Post date:** [September 10, 2014, 10:26am UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/13 "2014-09-10T10:26:32Z")
Well noted. ---
**Author:** ![Stein\_Inge\_Morisbak](https://avatars.discourse-cdn.com/v4/letter/s/d2c977/32.png) [@Stein\_Inge\_Morisbak](https://forum.ansible.com/u/Stein_Inge_Morisbak)\ **Post date:** [September 10, 2014, 11:32am UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/14 "2014-09-10T11:32:34Z")
Sorry about the tarball. It won’t happen again. After some further investigation it seems that it might have something to do with SELinux ACL after all. The httpd directory in /etc/httpd/conf has a dot after its access list (drwxr-xr-x.). I don’t know if this is the problem yet, but I will do some further investigations. Thanks for mentioning SELinux. I will keep you posted. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 10, 2014, 12:35pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/15 "2014-09-10T12:35:33Z")
Yeah, please let us know. One point of clarification - I think you may possibly be confusing SELinux and ACLs, which are different things. ACLs do not come from SELinux, they are managed by setfacl/etc. (There’s also a handy acl module in Ansible!) ---
**Author:** ![Stein\_Inge\_Morisbak](https://avatars.discourse-cdn.com/v4/letter/s/d2c977/32.png) [@Stein\_Inge\_Morisbak](https://forum.ansible.com/u/Stein_Inge_Morisbak)\ **Post date:** [November 5, 2014, 12:32pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/16 "2014-11-05T12:32:06Z")
Hi! It took some time before i could look into this. Anyway, I think it has to do with this issue: [https://github.com/ansible/ansible/issues/7372](https://github.com/ansible/ansible/issues/7372) The template-module always does `chown`, and that will not work when running as a non-root user when the files are owned by root even if the group has write permission. - Stein Inge kl. 14:35:36 UTC+2 onsdag 10. september 2014 skrev Michael DeHaan følgende: ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [November 5, 2014, 2:31pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/17 "2014-11-05T14:31:44Z")
Can you please share what version of Ansible you are using? (ansible --version) Thanks! ---
**Author:** ![Toshio\_Kuratomi](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@Toshio\_Kuratomi](https://forum.ansible.com/u/Toshio_Kuratomi)\ **Post date:** [November 5, 2014, 2:58pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/18 "2014-11-05T14:58:11Z")
From earlier on the thread 1.7.1 And yes, there have been some fixes to the devel branch related to owner and group since 1.7.1 that might be the cause of this. In addition to the two you’ve linked to, Stein, I believe there’s a third where specifying the file name rather than the directory as the destination was a work around. If you can checkout the development branch from git to test, that would confirm whether we’ve already fixed this for the next version or not. Some of those fixes may also have been pulled into the 1.7.2 release - the timing is right but I don’t recall whether they were added to that release or are waiting on 1.8. -Toshio ---
**Author:** ![Stein\_Inge\_Morisbak](https://avatars.discourse-cdn.com/v4/letter/s/d2c977/32.png) [@Stein\_Inge\_Morisbak](https://forum.ansible.com/u/Stein_Inge_Morisbak)\ **Post date:** [November 5, 2014, 4:29pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/19 "2014-11-05T16:29:24Z")
ansible 1.7.2 ---
**Author:** ![Stein\_Inge\_Morisbak](https://avatars.discourse-cdn.com/v4/letter/s/d2c977/32.png) [@Stein\_Inge\_Morisbak](https://forum.ansible.com/u/Stein_Inge_Morisbak)\ **Post date:** [December 16, 2014, 1:16pm UTC](https://forum.ansible.com/t/copy-fails-for-group-ownership/16145/20 "2014-12-16T13:16:49Z")
It works 🙂 I am using 1.8.1. kl. 17:54:30 UTC+1 onsdag 5. november 2014 skrev tkuratomi følgende: