Why am I getting this error from Ansible when trying to change the permissions on a file?

Question

I have the following task in a role named tomcat:

- name: copy tomcat file settings
  copy:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    owner: tomcat
    group: tomcat
    mode: "{{ item.mode }}"
  with_items:
  - { src: logrotate-tomcat7, dest: /etc/logrotate.d/tomcat7, mode: 0644 }
  - { src: keystore.pks, dest: /var/lib/tomcat7/webapps, mode: 0644  }
  - { src: jmxremote.access, dest: /etc/tomcat7, mode: 0644   }
  - { src: jmxremote.password, dest: /etc/tomcat7, mode: 0600 }

When I run the playbook that calls the tomcat role, I see the following output:

TASK [devops-server : copy tomcat file settings] *********************************
changed: [10.71.10.11] => (item={u'dest': u'/etc/logrotate.d/tomcat7', u'src': u'logrotate-tomcat7', u'mode': 420})
changed: [10.71.10.11] => (item={u'dest': u'/var/lib/tomcat7/webapps', u'src': u'keystore.pks', u'mode': 420})
changed: [10.71.10.11] => (item={u'dest': u'/etc/tomcat7', u'src': u'jmxremote.access', u'mode': 420})
failed: [10.71.10.11] (item={u'dest': u'/etc/tomcat7', u'src': u'jmxremote.password', u'mode': 384}) => {"checksum": "2203ad1530a3bc06732043ba67d129b5364505ce", "details": "bad symbolic permission for mode: 384", "failed": true, "gid": 91, "group": "tomcat", "item": {"dest": "/etc/tomcat7", "mode": 384, "src": "jmxremote.password"}, "mode": "0644", "msg": "mode must be in octal or symbolic form", "owner": "tomcat", "path": "/etc/tomcat7/jmxremote.password", "size": 52, "state": "file", "uid": 91}
...ignoring

Obviously, mode 0600 works on the command line of my EC2 instance:

ec2-user@devops-01 ~]$ sudo chmod 0600 /etc/tomcat7/jmxremote.password
ec2-user@devops-01 ~]$ ls -l /etc/tomcat7/jmxremote.password
-rw------- 1 tomcat tomcat 52 Oct 28 16:18 /etc/tomcat7/jmxremote.password

So what gives? Is this an Ansible bug or am I missing something?

Do the other three files get installed with the correct permissions (rw-r--r--)? — Paul Haldane, Oct 28 '16 at 16:45
@PaulHaldane Good point, and a good clue towards the source of the problem. The other files have `-r---w----` which is obviously as incorrect as the file causing me grief right now. Never bothered to check their permissions because it wasn't important for those files. — LegendaryDude, Oct 28 '16 at 17:37

score 4 · Accepted Answer · answered Oct 28 '16 at 17:23

This is obviously a bug in Ansible. To me the code seems fine. According to this GitHub Issue the error can be worked around by setting the octal for modeas a string. Like this: 0644 "0644"

So I would try this:

with_items:
 - { src: logrotate-tomcat7, dest: /etc/logrotate.d/tomcat7, mode: "0644" }

score 0 · Answer 2 · answered Mar 14 '23 at 20:53

Ansible changes. In ansible ansible-2.5.0-2.el6 and 2.9.27-1.el7ae, this plugin code was sufficient to read the mode correctly from a task:

module_args = dict(
    dest=dict(type='str', required=True),
    src=dict(type='str', required=True),
    owner=dict(type='str', required=False, default='root'),
    group=dict(type='str', required=False, default='root'),
    mode=dict(type='str', required=False, default='0600'),
    setype=dict(type='str', required=False),
    seuser=dict(type='str', required=False),
    selevel=dict(type='str', required=False)
)

# the AnsibleModule object will be our abstraction working with Ansible
# this includes instantiation, a couple of common attr would be the
# args/params passed to the execution, as well as if the module
# supports check mode
module = AnsibleModule(
    argument_spec=module_args,
    supports_check_mode=True
)
. . .
file_args = module.load_file_common_arguments(module.params)
result['changed'] |= module.set_fs_attributes_if_different(file_args, result['changed'], expand=False)

With ansible-2.9.25-1.el7, I had to crib this code from the java_keystore.py module:

class ArgumentSpec(object):
  def __init__(self):
    self.supports_check_mode = True
    self.add_file_common_args = True
    # define available arguments/parameters a user can pass to the module
    argument_spec = dict(
        dest=dict(type='str', required=True),
        src=dict(type='str', required=True),
    )
    self.argument_spec = argument_spec

spec = ArgumentSpec()
# the AnsibleModule object will be our abstraction working with Ansible
# this includes instantiation, a couple of common attr would be the
# args/params passed to the execution, as well as if the module
# supports check mode
module = AnsibleModule(
    argument_spec=spec.argument_spec,
    add_file_common_args=spec.add_file_common_args,
    supports_check_mode=spec.supports_check_mode
)
. . .
file_args = module.load_file_common_arguments(module.params)
result['changed'] |= module.set_fs_attributes_if_different(file_args, result['changed'], expand=False)

Why am I getting this error from Ansible when trying to change the permissions on a file?

2 Answers2