{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible/issues/13585","labels_url":"https://api.github.com/repos/ansible/ansible/issues/13585/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible/issues/13585/comments","events_url":"https://api.github.com/repos/ansible/ansible/issues/13585/events","html_url":"https://github.com/ansible/ansible/issues/13585","id":122769244,"number":13585,"title":"No PATH in Environment results in \"Permission denied\" for tasks on localhost","user":{"login":"knorchbold","id":7815056,"avatar_url":"https://avatars.githubusercontent.com/u/7815056?v=3","gravatar_id":"","url":"https://api.github.com/users/knorchbold","html_url":"https://github.com/knorchbold","followers_url":"https://api.github.com/users/knorchbold/followers","following_url":"https://api.github.com/users/knorchbold/following{/other_user}","gists_url":"https://api.github.com/users/knorchbold/gists{/gist_id}","starred_url":"https://api.github.com/users/knorchbold/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/knorchbold/subscriptions","organizations_url":"https://api.github.com/users/knorchbold/orgs","repos_url":"https://api.github.com/users/knorchbold/repos","events_url":"https://api.github.com/users/knorchbold/events{/privacy}","received_events_url":"https://api.github.com/users/knorchbold/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ansible/ansible/labels/bug_report","name":"bug_report","color":"fbca04"},{"url":"https://api.github.com/repos/ansible/ansible/labels/needs_info","name":"needs_info","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/ansible/ansible/milestones/5","html_url":"https://github.com/ansible/ansible/milestones/v2","labels_url":"https://api.github.com/repos/ansible/ansible/milestones/5/labels","id":975800,"number":5,"title":"v2","description":null,"creator":{"login":"bcoca","id":836171,"avatar_url":"https://avatars.githubusercontent.com/u/836171?v=3","gravatar_id":"","url":"https://api.github.com/users/bcoca","html_url":"https://github.com/bcoca","followers_url":"https://api.github.com/users/bcoca/followers","following_url":"https://api.github.com/users/bcoca/following{/other_user}","gists_url":"https://api.github.com/users/bcoca/gists{/gist_id}","starred_url":"https://api.github.com/users/bcoca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcoca/subscriptions","organizations_url":"https://api.github.com/users/bcoca/orgs","repos_url":"https://api.github.com/users/bcoca/repos","events_url":"https://api.github.com/users/bcoca/events{/privacy}","received_events_url":"https://api.github.com/users/bcoca/received_events","type":"User","site_admin":false},"open_issues":26,"closed_issues":622,"state":"open","created_at":"2015-02-11T19:43:06Z","updated_at":"2015-12-18T16:07:28Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2015-12-17T16:23:51Z","updated_at":"2015-12-18T16:16:53Z","closed_at":null,"body":"##### Issue Type:\r\nBug Report\r\n\r\n##### Ansible Version:\r\nansible 2.1.0\r\n  config file = /etc/ansible/ansible.cfg\r\n  configured module search path = /usr/share/ansible\r\n\r\n##### Environment:\r\n\r\nDebian Jessie, but should not matter\r\n\r\n##### Summary:\r\n\r\nIf $PATH is not set in the environment, ansible uses an empty string for `ansible_python_interpreter` for localhost. This leads to a task failure with \"Permission denied\" when running tasks on localhost.\r\n\r\n(The problem did not appear with ansible 1.7.2 as shipped with Debian and only appeared when I switched to the development version)\r\n\r\n##### Steps To Reproduce:\r\n    root@foo:/ # env -i HOME=/root ansible -m shell -a : localhost\r\n\r\n##### Expected Results:\r\n    localhost | SUCCESS | rc=0 >>\r\n\r\n##### Actual Results:\r\n    localhost | FAILED | rc=0 >>\r\n    /bin/sh: 1: /root/.ansible/tmp/ansible-tmp-1450293879.27-221034150901375/command: Permission denied\r\n\r\nHere's the same command with PATH:\r\n\r\n    root@foo:/ # env -i HOME=/root PATH=\"/usr/sbin:/usr/bin:/sbin:/bin\" ansible -m shell -a : localhost\r\n    localhost | SUCCESS | rc=0 >>\r\n\r\nThe reason for this is that in https://github.com/ansible/ansible/blob/devel/lib/ansible/inventory/__init__.py#L453 the python interpreter for localhost is set to `sys.executable`, which is empty, if PATH is empty:\r\n\r\n    root@foo:/ # python -c 'import sys; print(sys.executable)'\r\n    /usr/bin/python\r\n    root@foo:/ # env -i python -c 'import sys; print(sys.executable)'\r\n    \r\nThe shebang for the shell module is then set to `#!` while preparing the module for execution, which leads to the `Permission denied` message. \r\n\r\nI spotted this, when running an ansible playbook from a remote host through `remctl`, which does not set PATH, so there is an actual use case where this problem might occur.\r\n\r\nI could not find a better way to reliably determine the python interpreter than using `sys.executable`. So I would suggest to print a warning message and ask the user to set `ansible_python_interpreter` in the inventory if `sys.executable` is empty, because it is really not obvious that no PATH results in \"Permission denied\".\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/ansible/ansible/issues/comments/165821129","html_url":"https://github.com/ansible/ansible/issues/13585#issuecomment-165821129","issue_url":"https://api.github.com/repos/ansible/ansible/issues/13585","id":165821129,"user":{"login":"knorchbold","id":7815056,"avatar_url":"https://avatars.githubusercontent.com/u/7815056?v=3","gravatar_id":"","url":"https://api.github.com/users/knorchbold","html_url":"https://github.com/knorchbold","followers_url":"https://api.github.com/users/knorchbold/followers","following_url":"https://api.github.com/users/knorchbold/following{/other_user}","gists_url":"https://api.github.com/users/knorchbold/gists{/gist_id}","starred_url":"https://api.github.com/users/knorchbold/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/knorchbold/subscriptions","organizations_url":"https://api.github.com/users/knorchbold/orgs","repos_url":"https://api.github.com/users/knorchbold/repos","events_url":"https://api.github.com/users/knorchbold/events{/privacy}","received_events_url":"https://api.github.com/users/knorchbold/received_events","type":"User","site_admin":false},"created_at":"2015-12-18T16:16:53Z","updated_at":"2015-12-18T16:16:53Z","body":"I poked around in python's source to see how sys.executable is assigned. It seems to be in Python-2.7.11/Modules/getpath.c in calculate_path(). The behaviour with the empty string is intended, there's even a comment about it there:\r\n\r\n    /* If there is no slash in the argv0 path, then we have to               \r\n     * assume python is on the user's $PATH, since there's no                \r\n     * other way to find a directory to start the search from.  If           \r\n     * $PATH isn't exported, you lose.                                       \r\n     */   "}}