-
Notifications
You must be signed in to change notification settings - Fork 149
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Module ansible.posix.firewalld returns permission denied even with a success change of settings #232
Comments
Hi @lucas-benedito, Thank you for reporting this issue. # getenforce
# ls -Z /etc/firewalld/firewalld.conf
# semanage fcontext -l|grep firewalld |
Hi Saito, It's me who originally opened this case in RH. Here is the output of requested commands:
Kind regards, |
@mzycki thank you for the information! I just wanted to make sure that you already restart firewalld service on your RHEL7.9 managed node or not. If you already did, was it successful without errors? # systemctl restart firewalld
# systemctl status firewalld |
@saito-hideki Yes, it looks like a successful restart:
|
@maxamillion @Akasurde Thanks! |
Hi @saito-hideki , I have the same error. Target OS: Oracle Linux 8.4. It occurs after setting SELinux to enforcing. I need to test with SElinux disabled. See below as well. |
@exelanz thank you for reporting the valuable information!
|
I'm seeing the same issue in Rocky 8
|
@saito-hideki @maxamillion please find here the output of the requested commands (problem persists): [root@anakin firewalld]# rpm -qa|grep firewall [root@anakin firewalld]# rpm -V firewalld [root@anakin firewalld]# rpm -V python-firewall [root@anakin firewalld]# rpm -V python3-firewall [root@anakin firewalld]# stat /etc/ [root@anakin firewalld]# stat /etc/firewalld [root@anakin firewalld]# stat /etc/firewalld/firewalld.conf |
Added error message: TASK [Set Firewall services at anakin] ************************************************************ |
@saito-hideki @maxamillion please see above. Thanks. |
@exelanz is there any chance to provide the output of your playbook with |
@saito-hideki here it is:
|
@exelanz thank you for the playbook output. ...snip...
debug3: mux_client_request_alive: done pid = 13537\r\n
debug3: mux_client_request_session: session request sent\r\n
debug3: mux_client_read_packet: read header failed: Broken pipe\r\n
debug2: Received exit status from master 0\r\n")
ERROR: Failed to load '/etc/firewalld/firewalld.conf': [Errno 13] Permission denied: '/etc/firewalld/firewalld.conf'
WARNING: [Errno 13] Permission denied: '/etc/firewalld/firewalld.conf'
WARNING: Using fallback firewalld configuration settings.
Using module file /home/vagrant/.ansible/collections/ansible_collections/ansible/posix/plugins/modules/firewalld.py
<anakin.schots.xyz> PUT /home/vagrant/.ansible/tmp/ansible-local-13538kmo7emoj/tmpxb1niha9 TO /home/opc/.ansible/tmp/ansible-tmp-1646744533.8097765-13555-7696519113420/AnsiballZ_firewalld.py
<anakin.schots.xyz> SSH: EXEC sftp -b - -vvv \
-C \
-o ControlMaster=auto \
-o ControlPersist=60s \
-o KbdInteractiveAuthentication=no \
-o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey \
-o PasswordAuthentication=no \
-o 'User="opc"' \
-o ConnectTimeout=10 \
-o ControlPath=/home/vagrant/.ansible/cp/b482d96a35 '[anakin.schots.xyz]'
<anakin.schots.xyz> (0, b'sftp> put /home/vagrant/.ansible/tmp/ansible-local-13538kmo7emoj/tmpxb1niha9 /home/opc/.ansible/tmp/ansible-tmp-1646744533.8097765-13555-7696519113420/AnsiballZ_firewalld.py\n', b'OpenSSH_8.0p1, OpenSSL 1.1.1k FIPS 25 Mar 2021\r\n
debug1: Reading configuration data /etc/ssh/ssh_config\r\n
debug3: /etc/ssh/ssh_config line 52: Including file /etc/ssh/ssh_config.d/05-redhat.conf depth 0\r\n
debug1: Reading configuration data /etc/ssh/ssh_config.d/05-redhat.conf\r\n
debug2: checking match for \'final all\' host anakin.schots.xyz originally anakin.schots.xyz\r\n
...snip... Eventually, firewalld module succeeded without any issues like below:
@maxamillion @Akasurde What do you guys think about this error? |
@saito-hideki I have ran the playbook on my Mac and the error did not occur. Maybe some issue with Linux OS I am using normally? I have included -vvvv output for your reference:
|
It seems this post is old, but I was trying to figure out the exact same issue. Any updates on this ? Did anyone figure it out ? |
@rkhshan I tested today on Rocky Linux 9 and the issue did not occur. I will test on Oracle Linux as well. |
Oracle Linux 8.7, also no problem. |
@exelanz I have this problem on both RHEL8 & RHEL9. |
@rkhshan just tested on RHEL9. No issues. I am running Ansible on Mac. |
If you run as root you likely won't face any issues. If you run as an unprivileged user the issue on Fedora/RHEL is caused by stock permissions on directories in, and including
|
SUMMARY
When setting rich_rule using the module ansible.posix.firewalld, an error is displayed and the task is changed successfully.
ISSUE TYPE
COMPONENT NAME
firewall
ANSIBLE VERSION
COLLECTION VERSION
OS / ENVIRONMENT
Red Hat Enterprise Linux Server release 7.9 (Maipo)
STEPS TO REPRODUCE
Execute playbook below against an RHEL 7.9 machine.
redacted source_address
EXPECTED RESULTS
A changed task without errors.
ACTUAL RESULTS
The text was updated successfully, but these errors were encountered: