{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/778","labels_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/778/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/778/comments","events_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/778/events","html_url":"https://github.com/ansible/ansible-modules-core/issues/778","id":57474604,"number":778,"title":"file module recursive mode incorrectly sets file permissions","user":{"login":"shepdelacreme","id":5123728,"avatar_url":"https://avatars.githubusercontent.com/u/5123728?v=3","gravatar_id":"","url":"https://api.github.com/users/shepdelacreme","html_url":"https://github.com/shepdelacreme","followers_url":"https://api.github.com/users/shepdelacreme/followers","following_url":"https://api.github.com/users/shepdelacreme/following{/other_user}","gists_url":"https://api.github.com/users/shepdelacreme/gists{/gist_id}","starred_url":"https://api.github.com/users/shepdelacreme/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shepdelacreme/subscriptions","organizations_url":"https://api.github.com/users/shepdelacreme/orgs","repos_url":"https://api.github.com/users/shepdelacreme/repos","events_url":"https://api.github.com/users/shepdelacreme/events{/privacy}","received_events_url":"https://api.github.com/users/shepdelacreme/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ansible/ansible-modules-core/labels/bug_report","name":"bug_report","color":"fbca04"},{"url":"https://api.github.com/repos/ansible/ansible-modules-core/labels/P2","name":"P2","color":"fad8c7"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-02-12T15:29:21Z","updated_at":"2015-02-16T15:54:25Z","closed_at":"2015-02-16T15:54:25Z","body":"##### Issue Type:\r\nBug Report\r\n\r\n##### Ansible Version:\r\n```\r\nansible 1.8.2\r\n  configured module search path = None\r\n```\r\n##### Environment:\r\nControl Machine: OS X 10.10.2\r\nTarget Machine: RHEL 6.6\r\n\r\n##### Summary:\r\n\r\nWhen trying to recursively set file mode using symbolic format the ansible file module will incorrectly set permissions on some files. Specifically I experienced this issue when trying to ensure that all files in /usr/bin have 755 or less permissive permissions set. To do this you should be able to say \"mode=go-w\". This should remove write perms from group and other for any file in /usr/bin. However this does not work on certain files. i.e.\r\n\r\n/usr/bin/sudo\r\n/usr/bin/sudoreplay\r\n\r\n##### Steps To Reproduce:\r\nCheck permissions of files in /usr/bin before running commands:\r\n```\r\n# ls -la /usr/bin/sudo\r\n---s--x--x. 1 root root 123832 Jul 31  2014 /usr/bin/sudo\r\n```\r\n\r\nRun either of the following commands:\r\n```\r\n- hosts: all\r\n  sudo: yes\r\n\r\n  tasks:\r\n    - name: Set file perms recursively\r\n      file: path=/usr/bin owner=root mode=go-w recurse=yes\r\n```\r\n\r\n```\r\nansible -i hosts -m file --args=\"path=/usr/bin owner=root recurse=yes mode=go-w\" -u ec2-user --sudo\r\n```\r\n\r\n##### Expected Results:\r\n\r\nThis above commands should do nothing against a default /usr/bin/sudo file. If you add group or other write permissions before running the above commands then those write permissions should be removed. To see the expected results run the above command against a single file.\r\n\r\n##### Actual Results:\r\nCheck permissions after running above commands:\r\n```\r\n# ls -la /usr/bin/sudo\r\n-rwxr-xr-x. 1 root root 123832 Jul 31  2014 /usr/bin/sudo\r\n```\r\nFix sudo so the box isn't completely hosed:\r\n```\r\n# chmod 4111 /usr/bin/sudo\r\n```"},"comment":{"url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/comments/74529097","html_url":"https://github.com/ansible/ansible-modules-core/issues/778#issuecomment-74529097","issue_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/778","id":74529097,"user":{"login":"abadger","id":209242,"avatar_url":"https://avatars.githubusercontent.com/u/209242?v=3","gravatar_id":"","url":"https://api.github.com/users/abadger","html_url":"https://github.com/abadger","followers_url":"https://api.github.com/users/abadger/followers","following_url":"https://api.github.com/users/abadger/following{/other_user}","gists_url":"https://api.github.com/users/abadger/gists{/gist_id}","starred_url":"https://api.github.com/users/abadger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abadger/subscriptions","organizations_url":"https://api.github.com/users/abadger/orgs","repos_url":"https://api.github.com/users/abadger/repos","events_url":"https://api.github.com/users/abadger/events{/privacy}","received_events_url":"https://api.github.com/users/abadger/received_events","type":"User","site_admin":false},"created_at":"2015-02-16T15:54:24Z","updated_at":"2015-02-16T15:54:24Z","body":"Okay, I think those commits ought to fix this issue.  What happens now is:\r\n\r\n* In general when we encounter a symlink, if follow=False we make sure that we have not changed the permissions of the file pointed to by the symlink.\r\n* If follow=True, then we find the file being pointed to, get its permissions, and change that to the new permissions.\r\n* With recurse=True and follow=True, anytime we encounter a symlink to a directory we both modify permissions on the symlink and the directory.  Then we recurse into the directory to modify permissions on the contained files as well. \r\n\r\nThe first two behaviour changes should be enough to fix this issue (the specific issue and other, similar ways in which it could be encountered.).\r\n\r\nThanks for pointing out the problem!\r\n\r\nClosing This Ticket\r\n===================\r\n\r\nHi!\r\n\r\nWe believe recent commits (likely detailed above) should resolve this question or problem for you.\r\n\r\nThis will also be included in the next major release.\r\n\r\nIf you continue seeing any problems related to this issue, or if you have any further questions, please let us know by stopping by one of the two mailing lists, as appropriate:\r\n\r\n   * https://groups.google.com/forum/#!forum/ansible-project - for user questions, tips, and tricks\r\n   * https://groups.google.com/forum/#!forum/ansible-devel - for strategy, future planning, and questions about writing code\r\n\r\nBecause this project is very active, we're unlikely to see comments made on closed tickets, but the mailing list is a great way to ask questions, or post if you don't think this particular\r\nissue is resolved.\r\n\r\nThank you!\r\n\r\n\r\n"}}