search

ansible-collections / ansible.windows

Windows core collection for Ansible
https://galaxy.ansible.com/ansible/windows
GNU General Public License v3.0
249 stars 169 forks source link

"unauthorized operation" error when installing package form CD-ROM (read only device) #142

Closed ruzickap closed 3 years ago

ruzickap commented 3 years ago
SUMMARY

I'm using the win_package to install the qemu-ga-x86_64.msi package the from CD-ROM (read-only) device:

- name: Install Qemu Guest Agent (qemu-ga-x64.msi)
  win_package:
    path: "{{ virtio_win_iso_path }}\\guest-agent\\qemu-ga-x86_64.msi"
    creates_path: "{{ ansible_env['ProgramFiles'] }}\\qemu-ga"

Ansible is giving me this error:

    qemu: TASK [ansible-role-virtio-win : Install Qemu Guest Agent (qemu-ga-x64.msi)] ****
    qemu: task path: /Users/ruzickap/git/packer-templates/ansible/roles/ansible-role-virtio-win/tasks/virtio-win.yml:79
    qemu: Thursday 03 December 2020  06:59:47 +0100 (0:00:11.707)       0:03:07.773 *****
    qemu: redirecting (type: modules) ansible.builtin.win_package to ansible.windows.win_package
    qemu: Using module file /usr/local/Cellar/ansible/2.10.3_1/libexec/lib/python3.9/site-packages/ansible_collections/ansible/windows/plugins/modules/win_package.ps1
    qemu: Pipelining is enabled.
    qemu: <127.0.0.1> ESTABLISH WINRM CONNECTION FOR USER: vagrant on PORT 2507 TO 127.0.0.1
    qemu: EXEC (via pipeline wrapper)
    qemu: The full traceback is:
    qemu: Attempted to perform an unauthorized operation.
    qemu: At line:422 char:12
    qemu: +     $acl | Set-Acl -LiteralPath $path
    qemu: +            ~~~~~~~~~~~~~~~~~~~~~~~~~~
    qemu:     + CategoryInfo          : PermissionDenied: (E:\virtio-win\g...u-ga-x86_64.msi:String) [Set-Acl], UnauthorizedAccessException
    qemu:     + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetAclCommand
    qemu:
    qemu: ScriptStackTrace:
    qemu: at Add-SystemReadAce, <No file>: line 422
    qemu: at <ScriptBlock>, <No file>: line 790
    qemu: at <ScriptBlock>, <No file>: line 1386
    qemu:
    qemu: System.UnauthorizedAccessException: Attempted to perform an unauthorized operation.
    qemu:    at System.Security.AccessControl.Win32.SetSecurityInfo(ResourceType type, String name, SafeHandle handle, SecurityInfos securityInformation, SecurityIdentifier owner, SecurityIdentifier group, GenericAcl sacl, GenericAcl dacl)
    qemu:    at System.Security.AccessControl.NativeObjectSecurity.Persist(String name, SafeHandle handle, AccessControlSections includeSections, Object exceptionContext)
    qemu:    at System.Security.AccessControl.NativeObjectSecurity.Persist(String name, AccessControlSections includeSections, Object exceptionContext)
    qemu:    at System.Security.AccessControl.FileSystemSecurity.Persist(String fullPath)
    qemu:    at Microsoft.PowerShell.Commands.FileSystemProvider.SetSecurityDescriptor(String path, ObjectSecurity sd, AccessControlSections sections)
    qemu:    at Microsoft.PowerShell.Commands.FileSystemProvider.SetSecurityDescriptor(String path, ObjectSecurity securityDescriptor)
    qemu:    at System.Management.Automation.SessionStateInternal.SetSecurityDescriptor(CmdletProvider providerInstance, String path, ObjectSecurity securityDescriptor, CmdletProviderContext context)
    qemu: fatal: [127.0.0.1]: FAILED! => {
    qemu:     "changed": false,
    qemu:     "msg": "Unhandled exception while executing module: Attempted to perform an unauthorized operation."
    qemu: }
    qemu:
    qemu: PLAY RECAP *********************************************************************
    qemu: 127.0.0.1                  : ok=14   changed=10   unreachable=0    failed=1    skipped=5    rescued=0    ignored=0

(The Ansible code is called from Packer)

The full code can be found here: https://github.com/ruzickap/ansible-role-virtio-win/blob/d918586fa811f4e45a64b386b581d3179cb95828/tasks/virtio-win.yml#L79-L82

This was working fine in Ansible 2.9

It seems like Set-Acl from this file https://github.com/ansible-collections/ansible.windows/blob/28ce8268ca0a0fbc6ebfed456efd242ff4799aa3/plugins/modules/win_package.ps1#L421 is trying to do the change on read-only device. But I'm just guessing...

ISSUE TYPE
COMPONENT NAME
win_package
ANSIBLE VERSION
$ ansible --version                                                                                                       
ansible 2.10.3
  config file = /Users/ruzickap/.ansible.cfg
  configured module search path = ['/Users/ruzickap/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/Cellar/ansible/2.10.3_1/libexec/lib/python3.9/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.9.0 (default, Nov 30 2020, 15:21:09) [Clang 12.0.0 (clang-1200.0.32.27)]
CONFIGURATION
$ ansible-config dump --only-changed
ANSIBLE_PIPELINING(/Users/ruzickap/.ansible.cfg) = True
ANSIBLE_SSH_CONTROL_PATH(/Users/ruzickap/.ansible.cfg) = ~/.ansible/tmp/ansible-%%r@%%h:%%p
CACHE_PLUGIN(/Users/ruzickap/.ansible.cfg) = memory
DEFAULT_CALLBACK_WHITELIST(/Users/ruzickap/.ansible.cfg) = ['profile_roles', 'profile_tasks', 'timer']
DEFAULT_FORKS(/Users/ruzickap/.ansible.cfg) = 50
DEFAULT_LOCAL_TMP(/Users/ruzickap/.ansible.cfg) = /tmp/ansible-local-23817441dvf82
DEFAULT_MANAGED_STR(/Users/ruzickap/.ansible.cfg) = Ansible managed: {file} modified on %Y-%m-%d %H:%M:%S
DIFF_ALWAYS(/Users/ruzickap/.ansible.cfg) = True
HOST_KEY_CHECKING(/Users/ruzickap/.ansible.cfg) = False
INTERPRETER_PYTHON(/Users/ruzickap/.ansible.cfg) = auto_silent
OS / ENVIRONMENT

MacOS 10.15.7

jborean93 commented 3 years ago

Thanks for the bug report, the Set-Acl work is done so that msiexec can access the .msi file. It seems like msiexec spawns some system process which runs as SYSTEM which is why we set the temporary ACE to allow it. We will need to have a check to see if the file system is read-only/allows ACEs or just ignore the error and hope for the best.

jborean93 commented 3 years ago

Here is a PR that should fix this issue for you https://github.com/ansible-collections/ansible.windows/pull/147.

ruzickap commented 3 years ago

Thank you for a quick response.

I replaced my win_package.ps1 by your https://github.com/jborean93/ansible.windows/blob/win_package-acl/plugins/modules/win_package.ps1 from the #147 and now I'm getting this error:

    qemu: task path: /Users/ruzickap/git/packer-templates/ansible/roles/ansible-role-virtio-win/tasks/virtio-win.yml:79
    qemu: Monday 07 December 2020  08:55:57 +0100 (0:00:11.666)       0:02:55.584 *******
    qemu: redirecting (type: modules) ansible.builtin.win_package to ansible.windows.win_package
    qemu: Using module file /usr/local/Cellar/ansible/2.10.3_1/libexec/lib/python3.9/site-packages/ansible_collections/ansible/windows/plugins/modules/win_package.ps1
    qemu: Pipelining is enabled.
    qemu: <127.0.0.1> ESTABLISH WINRM CONNECTION FOR USER: vagrant on PORT 4342 TO 127.0.0.1
    qemu: EXEC (via pipeline wrapper)
    qemu: The full traceback is:
    qemu: The term 'None' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
    qemu: At line:1 char:1
    qemu: + None
    qemu: + ~~~~
    qemu:     + CategoryInfo          : ObjectNotFound: (None:String) [], ParentContainsErrorRecordException
    qemu:     + FullyQualifiedErrorId : CommandNotFoundException
    qemu:
    qemu: ScriptStackTrace:
    qemu: at <ScriptBlock>, <No file>: line 1
    qemu: fatal: [127.0.0.1]: FAILED! => {
    qemu:     "changed": false,
    qemu:     "msg": "Unhandled exception while executing module: The term 'None' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again."
    qemu: }

I'm not sure if I can "easily" replace the win_package.ps1 in Ansible 2.10.3 by the one from the #147, but I just give it a go trying to test it.

Let me know if there is "better" way how I can test the PR.

Thank you

jborean93 commented 3 years ago

That’s a very weird error message, it would indicate that the module didn’t have the correct contents. There’s nothing special in that PR that makes it incompatible with what comes with 2.10.x.

ruzickap commented 3 years ago

Thank you... I did the tests again and the PR fixed the issue.

Thanks again... (I hope it will be merged soon)

jborean93 commented 3 years ago

Just waiting your confirmation :). I’ll merge it tomorrow and am planning on creating a new release sometime next week.