Repository: ansible/ansible

Issue:
Issues with tmp file permissions on Solaris 11 (become: true)
<!--- Verify first that your issue/request is not already reported in GitHub -->
##### ISSUE TYPE

<!--- Pick one below and delete the rest: -->
- Bug Report
##### ANSIBLE VERSION

<!--- Paste verbatim output from “ansible --version” between quotes below -->

```
ansible 2.1.0.0 (stable-2.1 b950f75489) last updated 2016/06/06 14:33:25 (GMT +200)
```
##### CONFIGURATION

<!---
Mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).
-->
##### OS / ENVIRONMENT

<!---
Mention the OS you are running Ansible from, and the OS you are
managing, or say “N/A” for anything that is not platform-specific.
-->

```
                            Oracle Solaris 11.2 SPARC
  Copyright (c) 1983, 2015, Oracle and/or its affiliates.  All rights reserved.
                             Assembled 18 June 2015
```
##### SUMMARY

<!--- Explain the problem briefly -->

When using become: true e.g. with the ping, or any other plugin, Ansible fails with the following error:

```
fatal: [x.x.x.x]: FAILED! => {"failed": true, "msg": "Failed to set permissions on the temporary files Ansible needs to create when becoming an unprivileged user. For information on working around this, see https://docs.ansible.com/ansible/become.html#becoming-an-unprivileged-user"}
```

NB: {{ansible_become_user}} is an unprivileged account!
##### STEPS TO REPRODUCE

<!---
For bugs, show exactly how to reproduce the problem.
For new features, show how the feature would be used.
-->

<!--- Paste example playbooks or commands between quotes below -->

```

---
- hosts: all
  gather_facts: false

  tasks:
    - ping:
```

{{ansible_become}} must be true for the host(s).
{{ansible_become_user}} is an unprivileged user. (not sure if this makes a difference or not)

<!--- You can also paste gist.github.com links for larger files -->
##### EXPECTED RESULTS

<!--- What did you expect to happen when running the steps above? -->

Module returns with no error (correct Solaris setfacl syntax being used).
##### ACTUAL RESULTS

<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->

Module fails due to incorrect setfacl syntax:

```
$> setfacl -R -m u:oracle:rX /tmp/ansible-tmp-1466065441.97-217633078689232/
setfacl: illegal option -- R
```

<!--- Paste verbatim command output between quotes below -->

```
<x.x.x.x> SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=1800s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=XXX -o ConnectTimeout=60 -o ControlPath=/tmp/ansible/cp/ansible-ssh-%h-%p-%r x.x.x.x '/bin/sh -c '"'"'setfacl -R -m u:oracle:rX /tmp/ansible-tmp-1466066725.26-124215742920971/ && sleep 0'"'"''

fatal: [x.x.x.x]: FAILED! => {"failed": true, "msg": "Failed to set permissions on the temporary files Ansible needs to create when becoming an unprivileged user. For information on working around this, see https://docs.ansible.com/ansible/become.html#becoming-an-unprivileged-user"}
```



Discussion:
I'm wondering why this isn't falling back to chown... On your version of Solaris, are you able to give away files?  ie: chown as an unprivileged user will successfully assign ownership of the file to the other user?

No, I cannot (as ansible_user is an unprivileged account). 

But we do the same type of things on Linux hosts without any issues... (cannot change group/ownership from ansible_user to ansible_become_user account there either)

@rawbertp What I mean is -- I recently received a bug report from a  HP-UX user who claimed that he had tested chown on Solaris and it had the same behaviour as HP-UX: chown as an unprivileged user can give a file to another user.  Want to figure out whether that was entirely false or a different version of Solaris or perhaps a config option (My reading indicates that it's configurable on HP-UX).


Resolving patch:
diff --git a/lib/ansible/plugins/shell/__init__.py b/lib/ansible/plugins/shell/__init__.py
--- a/lib/ansible/plugins/shell/__init__.py
+++ b/lib/ansible/plugins/shell/__init__.py
@@ -91,10 +91,11 @@ def set_user_facl(self, path, user, mode, recursive=True):
         mode = pipes.quote(mode)
         user = pipes.quote(user)
 
-        cmd = ['setfacl']
+        cmd = ['setfacl', '-m', 'u:%s:%s' % (user, mode)]
         if recursive:
-            cmd.append('-R')
-        cmd.extend(('-m', 'u:%s:%s %s' % (user, mode, path)))
+            cmd = ['find', path, '-exec'] + cmd + ["'{}'", "';'"]
+        else:
+            cmd.append(path)
 
         return ' '.join(cmd)
 


Test patch: