podman_unshare become module does not work (asks for sudo password, or Operation not permitted) #545
Labels
needs_info
More information about case is required
Comments
|
@nodiscc did you try the latest code from master? |
Sorry, I did not have the time to do so yet. I will try to check with the latest code from master in the coming weeks. |
|
I can still reproduce this after installing the collection from git master (I think I followed the correct installation procedure, please correct me if not): $ cat requirements.ymlcollections:
- ...
- name: containers.podman
source: git+https://github.com/containers/ansible-podman-collections
type: git
version: master$ cat roles/shaarli-podman/tasks/shaarli-podman.yml- containers.podman.podman_volume:
state: present
name: "{{ item }}"
with_items:
- shaarli-data
- shaarli-cache
- name: set permissions/ownership on podman volumes
become: yes
become_method: containers.podman.podman_unshare
become_user: "{{ ansible_user }}"
ansible.builtin.file:
state: directory
owner: 100
group: 101
path: "{{ item }}"
with_items:
- ~/.local/share/containers/storage/volumes/shaarli-cache
- ~/.local/share/containers/storage/volumes/shaarli-data$ ansible-galaxy collection install --force -r requirements.yml
...
Installing 'containers.podman:1.10.1' to '/home/live/GIT/ansible-playbook-infra.git/ansible_collections/containers/podman'
Skipping '/home/live/.ansible/tmp/ansible-local-61852glbjwz4/tmp0g9knzl5/ansible-podman-collectionselasoavn/ci' for collection build
Skipping '/home/live/.ansible/tmp/ansible-local-61852glbjwz4/tmp0g9knzl5/ansible-podman-collectionselasoavn/contrib' for collection build
Skipping '/home/live/.ansible/tmp/ansible-local-61852glbjwz4/tmp0g9knzl5/ansible-podman-collectionselasoavn/galaxy.yml' for collection build
Skipping '/home/live/.ansible/tmp/ansible-local-61852glbjwz4/tmp0g9knzl5/ansible-podman-collectionselasoavn/.gitignore' for collection build
Skipping '/home/live/.ansible/tmp/ansible-local-61852glbjwz4/tmp0g9knzl5/ansible-podman-collectionselasoavn/.github' for collection build
Skipping '/home/live/.ansible/tmp/ansible-local-61852glbjwz4/tmp0g9knzl5/ansible-podman-collectionselasoavn/galaxy.yml.in' for collection build
Skipping '/home/live/.ansible/tmp/ansible-local-61852glbjwz4/tmp0g9knzl5/ansible-podman-collectionselasoavn/.git' for collection build
Created collection for containers.podman:1.10.1 at /home/live/GIT/ansible-playbook-infra.git/ansible_collections/containers/podman
containers.podman:1.10.1 was installed successfully
$ ansible-galaxy collection list | grep containers.podman
Found installed collection containers.podman:1.10.1 at '/home/live/GIT/ansible-playbook-infra.git/.venv/lib/python3.9/site-packages/ansible_collections/containers/podman'
containers.podman 1.10.1
Found installed collection containers.podman:1.10.1 at '/home/live/GIT/ansible-playbook-infra.git/ansible_collections/containers/podman'
containers.podman 1.10.1
$ ansible-playbook playbook.yml --tags=podman-shaarli
...
TASK [shaarli-podman : set permissions/ownership on podman volumes] ************************************************************************************************************************************************************************************************************
task path: /home/live/GIT/ansible-playbook-infra.git/roles/shaarli-podman/tasks/shaarli-podman.yml:8
Using module file /home/live/playbooks/default/.venv/lib/python3.9/site-packages/ansible/modules/file.py
Pipelining is enabled.
<podman1.xinit.se> ESTABLISH SSH CONNECTION FOR USER: deploy
<podman1.xinit.se> SSH: EXEC ssh -o ControlMaster=auto -o ControlPersist=3600s -o PreferredAuthentications=publickey -o 'IdentityFile="/home/live/.ssh/id_rsa"' -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="deploy"' -o ConnectTimeout=10 -o 'ControlPath="/home/live/.ansible/cp/89d9f44442"' podman1.xinit.se '/bin/sh -c '"'"'/usr/bin/python3 && sleep 0'"'"''
<podman1.xinit.se> (1, b'\n{"path": "/home/deploy/.local/share/containers/storage/volumes/shaarli-cache", "failed": true, "msg": "chown failed: [Errno 1] Operation not permitted: b\'/home/deploy/.local/share/containers/storage/volumes/shaarli-cache\'", "exception": " File \\"/tmp/user/1000/ansible_ansible.builtin.file_payload_m1guu5if/ansible_ansible.builtin.file_payload.zip/ansible/module_utils/basic.py\\", line 833, in set_owner_if_different\\n os.lchown(b_path, uid, -1)\\n", "uid": 100099, "gid": 100100, "owner": "100099", "group": "100100", "mode": "0755", "state": "directory", "size": 4096, "invocation": {"module_args": {"state": "directory", "owner": "100", "group": "101", "path": "/home/deploy/.local/share/containers/storage/volumes/shaarli-cache", "recurse": false, "force": false, "follow": true, "modification_time_format": "%Y%m%d%H%M.%S", "access_time_format": "%Y%m%d%H%M.%S", "unsafe_writes": false, "_original_basename": null, "_diff_peek": null, "src": null, "modification_time": null, "access_time": null, "mode": null, "seuser": null, "serole": null, "selevel": null, "setype": null, "attributes": null}}}\n', b'')
<podman1.xinit.se> Failed to connect to the host via ssh:
The full traceback is:
File "/tmp/user/1000/ansible_ansible.builtin.file_payload_m1guu5if/ansible_ansible.builtin.file_payload.zip/ansible/module_utils/basic.py", line 833, in set_owner_if_different
os.lchown(b_path, uid, -1)
failed: [podman1.xinit.se] (item=~/.local/share/containers/storage/volumes/shaarli-cache) => {
"ansible_loop_var": "item",
"changed": false,
"gid": 100100,
"group": "100100",
"invocation": {
"module_args": {
"_diff_peek": null,
"_original_basename": null,
"access_time": null,
"access_time_format": "%Y%m%d%H%M.%S",
"attributes": null,
"follow": true,
"force": false,
"group": "101",
"mode": null,
"modification_time": null,
"modification_time_format": "%Y%m%d%H%M.%S",
"owner": "100",
"path": "/home/deploy/.local/share/containers/storage/volumes/shaarli-cache",
"recurse": false,
"selevel": null,
"serole": null,
"setype": null,
"seuser": null,
"src": null,
"state": "directory",
"unsafe_writes": false
}
},
"item": "~/.local/share/containers/storage/volumes/shaarli-cache",
"mode": "0755",
"owner": "100099",
"path": "/home/deploy/.local/share/containers/storage/volumes/shaarli-cache",
"size": 4096,
"state": "directory",
"uid": 100099
}
MSG:
chown failed: [Errno 1] Operation not permitted: b'/home/deploy/.local/share/containers/storage/volumes/shaarli-cache'
Using module file /home/live/playbooks/default/.venv/lib/python3.9/site-packages/ansible/modules/file.py
Pipelining is enabled.
<podman1.xinit.se> ESTABLISH SSH CONNECTION FOR USER: deploy
<podman1.xinit.se> SSH: EXEC ssh -o ControlMaster=auto -o ControlPersist=3600s -o PreferredAuthentications=publickey -o 'IdentityFile="/home/live/.ssh/id_rsa"' -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="deploy"' -o ConnectTimeout=10 -o 'ControlPath="/home/live/.ansible/cp/89d9f44442"' podman1.xinit.se '/bin/sh -c '"'"'/usr/bin/python3 && sleep 0'"'"''
<podman1.xinit.se> (1, b'\n{"path": "/home/deploy/.local/share/containers/storage/volumes/shaarli-data", "failed": true, "msg": "chown failed: [Errno 1] Operation not permitted: b\'/home/deploy/.local/share/containers/storage/volumes/shaarli-data\'", "exception": " File \\"/tmp/user/1000/ansible_ansible.builtin.file_payload_w6ukbigg/ansible_ansible.builtin.file_payload.zip/ansible/module_utils/basic.py\\", line 833, in set_owner_if_different\\n os.lchown(b_path, uid, -1)\\n", "uid": 100099, "gid": 100100, "owner": "100099", "group": "100100", "mode": "0755", "state": "directory", "size": 4096, "invocation": {"module_args": {"state": "directory", "owner": "100", "group": "101", "path": "/home/deploy/.local/share/containers/storage/volumes/shaarli-data", "recurse": false, "force": false, "follow": true, "modification_time_format": "%Y%m%d%H%M.%S", "access_time_format": "%Y%m%d%H%M.%S", "unsafe_writes": false, "_original_basename": null, "_diff_peek": null, "src": null, "modification_time": null, "access_time": null, "mode": null, "seuser": null, "serole": null, "selevel": null, "setype": null, "attributes": null}}}\n', b'')
<podman1.xinit.se> Failed to connect to the host via ssh:
The full traceback is:
File "/tmp/user/1000/ansible_ansible.builtin.file_payload_w6ukbigg/ansible_ansible.builtin.file_payload.zip/ansible/module_utils/basic.py", line 833, in set_owner_if_different
os.lchown(b_path, uid, -1)
failed: [podman1.xinit.se] (item=~/.local/share/containers/storage/volumes/shaarli-data) => {
"ansible_loop_var": "item",
"changed": false,
"gid": 100100,
"group": "100100",
"invocation": {
"module_args": {
"_diff_peek": null,
"_original_basename": null,
"access_time": null,
"access_time_format": "%Y%m%d%H%M.%S",
"attributes": null,
"follow": true,
"force": false,
"group": "101",
"mode": null,
"modification_time": null,
"modification_time_format": "%Y%m%d%H%M.%S",
"owner": "100",
"path": "/home/deploy/.local/share/containers/storage/volumes/shaarli-data",
"recurse": false,
"selevel": null,
"serole": null,
"setype": null,
"seuser": null,
"src": null,
"state": "directory",
"unsafe_writes": false
}
},
"item": "~/.local/share/containers/storage/volumes/shaarli-data",
"mode": "0755",
"owner": "100099",
"path": "/home/deploy/.local/share/containers/storage/volumes/shaarli-data",
"size": 4096,
"state": "directory",
"uid": 100099
}
MSG:
chown failed: [Errno 1] Operation not permitted: b'/home/deploy/.local/share/containers/storage/volumes/shaarli-data'
to retry, use: --limit @/home/live/GIT/ansible-playbook-infra.git/playbook.retryCan you also reproduce it with the example tasks I provided? |
|
I am trying to understand what's going on, in the output I can't see podman unshare used |
Me neither, is it supposed to show something specific in the output? (Do you have an example of a working task that uses podman unshare?) The task is definitely called as documented in https://docs.ansible.com/ansible/latest/collections/containers/podman/podman_unshare_become.html : - name: set permissions/ownership on podman volumes
become: yes
become_method: containers.podman.podman_unshare
... |
|
@nodiscc Until I dive deeper, I paste my output of 'file' module I ran just now with this become plugin. You can see where become plugin stepped in, the line before the phrase "Escalation succeeded": |
|
... and the corresponding task: |
|
This was caused by - name: set permissions/ownership on podman volumes
become: yes
become_method: containers.podman.podman_unshare
ansible.builtin.file:
state: directory
owner: 100
group: 101
path: "{{ item }}"
with_items:
- ~/.local/share/containers/storage/volumes/shaarli-cache
- ~/.local/share/containers/storage/volumes/shaarli-data |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)
/kind bug
Description
Steps to reproduce the issue:
containers.podmancollectionansible-galaxy collection install containers.podman$ ansible-playbook playbook.yml --tags=podman-shaarliDescribe the results you received:
Thinking that was caused by
become: yesassumingbecome_user: rootas the default, I tried settingbecome_user: "{{ ansible_user }}"in the task that usesbecome_method: containers.podman.podman_unshare. Different error:Describe the results you expected:
become_method: containers.podman.podman_unshareshould work as documented in the examples at https://docs.ansible.com/ansible/latest/collections/containers/podman/podman_volume_module.html:become_usermanually/assume thatbecome_user: rootOperation not permitted) even withbecome_userset to the ansible unprivileged user.Additional information you deem important (e.g. issue happens only occasionally):
Running
podman unsharemanually works, pointing to a problem specifically with the become module:Version of the
containers.podmancollection:Output of
ansible --version:Output of
podman version:Output of
podman info --debug:Package info (e.g. output of
rpm -q podmanorapt list podman):Playbok you run with ansible (e.g. content of
playbook.yaml):Command line and output of ansible run with high verbosity
Additional environment details (AWS, VirtualBox, physical, etc.):
The text was updated successfully, but these errors were encountered: