[Bug] Permission issues while using zos_fetch module with ansible_become: true

Marty850 commented 2 months ago

Is there an existing issue for this?

[X] There are no existing issues.

Bug description

I run my playbook with -u AUTOUSER and change by ansible_become: true to ADMINUSER using ansible_become_flags '- -s'.

When I use the zos_fetch module like that:

    - name: "Fetch"      
      ibm.ibm_zos_core.zos_fetch:
        src: TEST.DATASET(MEMBER)
        dest: /tmp/
        flat: true

the module works like that:

Copy the MEMBER to /tmp/ with a temporary name like tmpbclvb8g4 with user ADMINUSER and set permissions to 600
Try to read the temporary file with AUTOUSER to copy it to the real destination

Because it uses AUTOUSER in step 2 it doesn't have permission to access the file gets ICH408I.

For me that looks like a bug. I think the module should use the ADMINUSER because of ansible_become: true

I use z/OS Ansible core Version 1.9.2 and was not able to select it in the template.

IBM z/OS Ansible core Version

v1.9.0 (default)

IBM Z Open Automation Utilities

v1.2.5 (default)

IBM Enterprise Python

v3.11.x (default)

ansible-version

v2.17.x

z/OS version

v3.1 (unsupported)

Ansible module

zos_fetch

Playbook verbosity output.

No response

Ansible configuration.

[defaults]
system_tmpdirs = /tmp

Contents of the inventory

No response

Contents of `group_vars` or `host_vars`

No response

Marty850 commented 2 months ago

It looks like the use of /tmp is hardcoded. I cannot manipulate it with system_tmpdirs or remote_tmp in ansible.cfg. I thought this could be a possible workaround

richp405 commented 2 months ago

@Marty850 We have had another report about /tmp still being hardcoded, and it is being researched.

for me: DD sent a blog link about become, so I can track the actions community/user/ibmz-and-linuxone/blogs/demetrios-dimatos1/2023/05/24/escalating-privileges-with-ansible-on-zos?communityKey=ce54fe94-0145-4832-a0ef-4ea81d6062cc

richp405 commented 2 months ago

@Marty850 I have a basic question: Are you setting become information in ansible.cfg or in the playbook itself?

Marty850 commented 2 months ago

@richp405 It's in the playbook itself

Marty850 commented 2 weeks ago

It looks like that the zos_copy module has a similar problem when you want to copy a local file to a USS target

ansible-collections / ibm_zos_core