{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible/issues/11385","labels_url":"https://api.github.com/repos/ansible/ansible/issues/11385/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible/issues/11385/comments","events_url":"https://api.github.com/repos/ansible/ansible/issues/11385/events","html_url":"https://github.com/ansible/ansible/issues/11385","id":90925489,"number":11385,"title":"template module doesn't set correct permissions on tmp file","user":{"login":"kustodian","id":1949229,"avatar_url":"https://avatars.githubusercontent.com/u/1949229?v=3","gravatar_id":"","url":"https://api.github.com/users/kustodian","html_url":"https://github.com/kustodian","followers_url":"https://api.github.com/users/kustodian/followers","following_url":"https://api.github.com/users/kustodian/following{/other_user}","gists_url":"https://api.github.com/users/kustodian/gists{/gist_id}","starred_url":"https://api.github.com/users/kustodian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kustodian/subscriptions","organizations_url":"https://api.github.com/users/kustodian/orgs","repos_url":"https://api.github.com/users/kustodian/repos","events_url":"https://api.github.com/users/kustodian/events{/privacy}","received_events_url":"https://api.github.com/users/kustodian/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ansible/ansible/labels/bug_report","name":"bug_report","color":"fbca04"},{"url":"https://api.github.com/repos/ansible/ansible/labels/P2","name":"P2","color":"fad8c7"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/ansible/ansible/milestones/5","html_url":"https://github.com/ansible/ansible/milestones/v2","labels_url":"https://api.github.com/repos/ansible/ansible/milestones/5/labels","id":975800,"number":5,"title":"v2","description":null,"creator":{"login":"bcoca","id":836171,"avatar_url":"https://avatars.githubusercontent.com/u/836171?v=3","gravatar_id":"","url":"https://api.github.com/users/bcoca","html_url":"https://github.com/bcoca","followers_url":"https://api.github.com/users/bcoca/followers","following_url":"https://api.github.com/users/bcoca/following{/other_user}","gists_url":"https://api.github.com/users/bcoca/gists{/gist_id}","starred_url":"https://api.github.com/users/bcoca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcoca/subscriptions","organizations_url":"https://api.github.com/users/bcoca/orgs","repos_url":"https://api.github.com/users/bcoca/repos","events_url":"https://api.github.com/users/bcoca/events{/privacy}","received_events_url":"https://api.github.com/users/bcoca/received_events","type":"User","site_admin":false},"open_issues":38,"closed_issues":132,"state":"open","created_at":"2015-02-11T19:43:06Z","updated_at":"2015-07-26T18:41:36Z","due_on":null,"closed_at":null},"comments":8,"created_at":"2015-06-25T10:38:11Z","updated_at":"2015-07-26T18:43:14Z","closed_at":"2015-07-26T18:41:36Z","body":"##### Issue Type:\r\n\r\nBug Report\r\n\r\n##### Ansible Version:\r\n\r\nansible 1.9.1 (v2 also has this issue)\r\n\r\n##### Environment:\r\n\r\nRunning on Ubuntu 15.04, managing Centos 5\r\n\r\n##### Summary:\r\n\r\nIf you set `mode` with the template module, that mode is not set on the tmp file, but only on the destination file. The problem with this is if you use `validate='visudo -csf %s'` which with `-s` checks file permissions as well, this fails, because the tmp file doesn't have 440 permissions, but the default ones.\r\n\r\n##### Steps To Reproduce:\r\n\r\nHere is an example playbook which fails on Centos 5:\r\n\r\n```\r\n# template.yml\r\n\r\n---\r\n- hosts: all\r\n  tasks:\r\n    - template: src=sudoers.d_file.j2 dest=/etc/sudoers.d/additional_rules\r\n                owner=root group=root mode=440\r\n                validate='visudo -csf %s'\r\n```\r\n```\r\n# sudoers.d_file.j2\r\n\r\n%group  ALL=(root) /bin/ls\r\n```\r\n\r\nRun on a Centos 5 host:\r\n```\r\nansible-playbook -i test_hosts template.yml\r\n```\r\nand you get this error:\r\n```\r\nTASK: [template src=sudoers.d_file.j2 dest=/etc/sudoers.d/additional_rules owner=root group=root mode=440 validate='visudo -csf %s'] *** \r\nfailed: [pg-02] => {\"failed\": true}\r\nmsg: failed to validate: rc:1 error:/root/.ansible/tmp/ansible-tmp-1435228545.88-41250953876536/source: bad permissions, should be mode 0440\r\n```\r\n\r\n##### Expected Results:\r\n\r\nThis command shouldn't fail, since the tmp file should have the correct permission set with the parameters."},"comment":{"url":"https://api.github.com/repos/ansible/ansible/issues/comments/125026354","html_url":"https://github.com/ansible/ansible/issues/11385#issuecomment-125026354","issue_url":"https://api.github.com/repos/ansible/ansible/issues/11385","id":125026354,"user":{"login":"jimi-c","id":26403,"avatar_url":"https://avatars.githubusercontent.com/u/26403?v=3","gravatar_id":"","url":"https://api.github.com/users/jimi-c","html_url":"https://github.com/jimi-c","followers_url":"https://api.github.com/users/jimi-c/followers","following_url":"https://api.github.com/users/jimi-c/following{/other_user}","gists_url":"https://api.github.com/users/jimi-c/gists{/gist_id}","starred_url":"https://api.github.com/users/jimi-c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimi-c/subscriptions","organizations_url":"https://api.github.com/users/jimi-c/orgs","repos_url":"https://api.github.com/users/jimi-c/repos","events_url":"https://api.github.com/users/jimi-c/events{/privacy}","received_events_url":"https://api.github.com/users/jimi-c/received_events","type":"User","site_admin":false},"created_at":"2015-07-26T18:43:14Z","updated_at":"2015-07-26T18:43:14Z","body":"Closing This Ticket\r\n===================\r\n\r\nHi!\r\n\r\nWe believe the above commit should resolve this problem for you. This will also be included in the next major release.\r\n\r\nIf you continue seeing any problems related to this issue, or if you have any further questions, please let us know by stopping by one of the two mailing lists, as appropriate:\r\n\r\n   * https://groups.google.com/forum/#!forum/ansible-project - for user questions, tips, and tricks\r\n   * https://groups.google.com/forum/#!forum/ansible-devel - for strategy, future planning, and questions about writing code\r\n\r\nBecause this project is very active, we're unlikely to see comments made on closed tickets, but the mailing list is a great way to ask questions, or post if you don't think this particular issue is resolved.\r\n\r\nThank you!"}}