# Permissions problem when copying file to a Solaris 10 host remote with unprivileged user **URL:** \ **Category:** Ansible Project\ **Created:** [September 16, 2019, 9:28pm UTC](https://forum.ansible.com/t/permissions-problem-when-copying-file-to-a-solaris-10-host-remote-with-unprivileged-user/31293 "2019-09-16T21:28:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Sur\_Veillor](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Sur\_Veillor](https://forum.ansible.com/u/Sur_Veillor)\ **Post date:** [September 16, 2019, 9:28pm UTC](https://forum.ansible.com/t/permissions-problem-when-copying-file-to-a-solaris-10-host-remote-with-unprivileged-user/31293/1 "2019-09-16T21:28:10Z")
Hello, i am a new user of ansible and i’m facing an issue to copy files with unprivilegied user (becom\_user method). I investigated a little bit and i think it might be a bug. Can you please take a look and tell me what you think about that ? First, i tried this play: **- name : Copy the JDK and Weblogic Installation files to ORACLE\_HOME** **become: yes** **become\_user: weblogic** **tags: app,cpbinaries** **copy:** **src: “{{ item }}”** **dest: “{{ oracle\_home }}”** **mode: 0755** **with\_items:** **- “fmw\_12.2.1.3.0\_wls.jar”** **- “server-jre-8u202-solaris-x64.tar.gz”** **- “oraInst.loc”** **- “install.file”** **- “DemoIdentity.jks”** and i get this error : **fatal: [solarisA]: FAILED! =\> {** **“msg”: “Failed to get information on remote file (/opt/oracle): Shared connection to solarisa closed.\r\n”** **}** so i switched to debug mode to detail all steps : 1 - Ansible creates remote temporaries directories **SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/ansible/.ansible/cp/bc112b7c2e solarisB ‘/bin/sh -c ‘"’"’( umask 77 && mkdir -p “`echo /var/tmp/ansible-tmp-1568504245.1231182-74525082315384`” && echo ansible-tmp-1568504245.1231182-74525082315384=“`echo /var/tmp/ansible-tmp-1568504245.1231182-74525082315384`” ) && sleep 0’“'”‘’** In this “become unprevilieged” context ansible creates his remote\_tmp directory on /var/tmp which have permissive permissions and is world read-write-excutable. 2 - Ansible puts via sftp his python script: **(0, b’sftp\> put /home/ansible/.ansible/tmp/ansible-local-614inxzagl8/tmpz32je0t9 /var/tmp/ansible-tmp-x.1231182-74525082315384/AnsiballZ\_stat.py\n’, b’')** this script needs to be executed by the unprivileged user (in this case weblogic), so setfacl is used to define extra acl for weblogic user (r-x) for directory and python script. 3 - Ansible sets special ACL\*\*:\*\* **SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/ansible/.ansible/cp/bc112b7c2e solarisB ‘/bin/sh -c ‘"’“‘setfacl -m u:weblogic:r-x /var/tmp/ansible-tmp-1568504245.1231182-74525082315384/ /var/tmp/ansible-tmp-1568504245.1231182-74525082315384/AnsiballZ\_stat.py && sleep 0’”’"‘’** 4 - Ansible executes his scripts with the “become\_user” and here comes the issue: **SSH: EXEC ssh -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/ansible/.ansible/cp/bc112b7c2e -tt solarisB ‘/bin/sh -c ‘"’“'sudo -H -S -n -u weblogic /bin/sh -c '”’“'”‘"’“'”‘"’“‘echo BECOME-SUCCESS-yphzzwuikysosecwybnqdmhqlrteqtqo ; /usr/bin/python /var/tmp/ansible-tmp-1568504245.1231182-74525082315384/AnsiballZ\_stat.py’”‘"’“'”‘"’“'”‘"’ && sleep 0’“'”‘’** **(2, b"/usr/bin/python: can’t open file ‘/var/tmp/ansible-tmp-1568504245.1231182-74525082315384/AnsiballZ\_stat.py’: [Errno 13] Permission denied\r\n", b’Shared connection to solarisb closed.\r\n’)** Checking of tmp files on the remote host reveals that acls are setted as expected. It explains also why permission still denied. Below the output of the getfacl command on both directory and file created by ansible : > **bash-3.2# getfacl /var/tmp/ansible-tmp-1568576958.2552567-161485945290729** > > **# file: /var/tmp/ansible-tmp-1568576958.2552567-161485945290729** > **# owner: ansible** > **# group: ansible** > **user::rwx** > **user:weblogic:r-x #effective:—** > **group::— #effective:—** > **mask:—** > **other:—** > **bash-3.2# getfacl /var/tmp/ansible-tmp-1568576958.2552567-161485945290729/AnsiballZ\_stat.py** > > **# file: /var/tmp/ansible-tmp-1568576958.2552567-161485945290729/AnsiballZ\_stat.py** > **# owner: ansible** > **# group: ansible** > **user::rw-** > **user:weblogic:r-x #effective:—** > **group::— #effective:—** > **mask:—** > **other:—** mask:— defines maximum permissions allow for users, so weblogic have no rights (#effective) this value is set when file or directory are created. By default it is value of the group, in my case is group::— so mask value is : mask:—. man of setfacl inform about -r option : > -r Recalculates the permissions for the ACL > mask entry. The permissions specified in > the ACL mask entry are ignored and > replaced by the maximum permissions neces- > sary to grant the access to all additional > user, file group owner, and additional > group entries in the ACL. The permissions > in the additional user, file group owner, > and additional group entries are left > unchanged. I tried to modify ansible’s code to add this option : _in /lib/ansible/plugins/shell/ **init**.py_ def set\_user\_facl(self, paths, user, mode): “”“Only sets acls for users as that’s really all we need”“” cmd = [‘setfacl’, ‘-r’, ‘-m’, ‘u:%s:%s’ % (user, mode)] cmd.extend(paths) cmd = [shlex\_quote(c) for c in cmd] i reran playbook and task ended successfully.ansible-playbook 2.8.5 In documentation i see an ‘allow\_world\_readable\_tmpfiles’ option but from what i understant it’s only active when ansible can’t set correct rights. In my case it seems that ansible doesn’t catch any errors to this level and doesn’t try to chmod his files. Is there an option permitting to choose how ansible set rights in his remote temporary directories ? ---
**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\ **Post date:** [September 17, 2019, 3:26am UTC](https://forum.ansible.com/t/permissions-problem-when-copying-file-to-a-solaris-10-host-remote-with-unprivileged-user/31293/2 "2019-09-17T03:26:35Z")
No. There is no such option. It seems that you've fixed the issue     Failure running command as non privileged user #16052     [https://github.com/ansible/ansible/issues/16052](https://github.com/ansible/ansible/issues/16052) Indeed, "setfacl" is missing the read permission "-r". You might want to create a pull request [https://github.com/ansible/ansible/blob/devel/lib/ansible/plugins/shell/\_\_init\_\_.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/plugins/shell/ __init__.py) As a side-note. This article explains the current situation [https://jpmens.net/2019/06/21/i-care-about-ansible/](https://jpmens.net/2019/06/21/i-care-about-ansible/) Thank you,   -vlado ---
**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\ **Post date:** [September 17, 2019, 8:46am UTC](https://forum.ansible.com/t/permissions-problem-when-copying-file-to-a-solaris-10-host-remote-with-unprivileged-user/31293/3 "2019-09-17T08:46:30Z")
setfacl "-r" option is not available in Linux. Linux man setfacl says        -n, --no-mask            Do not recalculate the effective rights mask. The default behavior        of setfacl is to recalculate the ACL mask entry, unless a mask        entry was explicitly given. The mask entry is set to the union of        all permissions of the owning group, and all named user and group        entries. (These are exactly the entries affected by the mask entry).        --mask            Do recalculate the effective rights mask, even if an ACL mask            entry was explicitly given. (See the -n option.) FWIW, "Solaris Working Group" might be interested to learn about it [https://github.com/ansible/community/wiki/Solaris](https://github.com/ansible/community/wiki/Solaris) Cheers,   -vlado ---
**Author:** ![Sur\_Veillor](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Sur\_Veillor](https://forum.ansible.com/u/Sur_Veillor)\ **Post date:** [September 17, 2019, 12:29pm UTC](https://forum.ansible.com/t/permissions-problem-when-copying-file-to-a-solaris-10-host-remote-with-unprivileged-user/31293/4 "2019-09-17T12:29:05Z")
Indeed, I checked the setfacl options on another distribution and they are not the same. Thank you Vladimir for your response and the links you have posted. ---
**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\ **Post date:** [September 17, 2019, 2:11pm UTC](https://forum.ansible.com/t/permissions-problem-when-copying-file-to-a-solaris-10-host-remote-with-unprivileged-user/31293/5 "2019-09-17T14:11:18Z")
You've probably found out, but just to be sure, "pipelining" could help meanwhile [https://docs.ansible.com/ansible/latest/user\_guide/become.html#becoming-an-unprivileged-user](https://docs.ansible.com/ansible/latest/user_guide/become.html#becoming-an-unprivileged-user) ---
**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\ **Post date:** [September 17, 2019, 2:23pm UTC](https://forum.ansible.com/t/permissions-problem-when-copying-file-to-a-solaris-10-host-remote-with-unprivileged-user/31293/6 "2019-09-17T14:23:08Z")
You've probably found out, but just to be sure, "pipelining" could help meanwhile [https://docs.ansible.com/ansible/latest/user\_guide/become.html#becoming-an-unprivileged-user](https://docs.ansible.com/ansible/latest/user_guide/become.html#becoming-an-unprivileged-user) But not for copy, fetch, template ...