ansible-community / molecule-plugins

Collection on molecule plugins
MIT License
114 stars 76 forks source link

sudo: unable to send audit message: Operation not permitted #80

Open ssbarnea opened 3 years ago

ssbarnea commented 3 years ago

After upgrading to containers.podman==1.6.2 and trying to user the molecule-podman driver from main, I encountered failure to gather facts in prepare step like:

TASK [Gathering Facts] ***************************************************************************************************************************************
[WARNING]: Unhandled error in Python interpreter discovery for host centos8: Expecting value: line 1 column 1 (char 0)
fatal: [centos8]: FAILED! => changed=false
  ansible_facts: {}
  failed_modules:
    setup:
      ansible_facts:
        discovered_interpreter_python: /usr/bin/python3.6
      failed: true
      module_stderr: |-
        sudo: unable to send audit message: Operation not permitted
      module_stdout: ''
      msg: |-
        MODULE FAILURE
        See stdout/stderr for the exact error
      rc: 0
      warnings:
      - Platform linux on host centos8 is using the discovered Python interpreter at /usr/bin/python3.6, but future installation of another Python interpreter could change this. See https://docs.ansible.com/ansible/2.9/reference_appendices/interpreter_discovery.html for more information.
  msg: |-
    The following modules failed to execute: setup

This happened with https://opendev.org/openstack/ansible-role-collect-logs/src/branch/master/roles/collect_logs/molecule/default scenario, the only change made was to switch driver from docker to podman.

I checked and container is running ok.

After removing pipelining option from config gathering started to work. Still this is a bug because we should not need to tune the config to make it work.

    ssh_connection:
      pipelining: true

@sshnaidm we should look into this tomorrow.

markstos commented 2 years ago

The issue is that the container needs the audit write capability (or the attempted use of the capability needs to be removed).

Ref: https://github.com/pi-hole/docker-pi-hole/issues/1007#issuecomment-1053208134