I have the following task in a role named tomcat:

- name: copy tomcat file settings
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    owner: tomcat
    group: tomcat
    mode: "{{ item.mode }}"
  - { src: logrotate-tomcat7, dest: /etc/logrotate.d/tomcat7, mode: 0644 }
  - { src: keystore.pks, dest: /var/lib/tomcat7/webapps, mode: 0644  }
  - { src: jmxremote.access, dest: /etc/tomcat7, mode: 0644   }
  - { src: jmxremote.password, dest: /etc/tomcat7, mode: 0600 }

When I run the playbook that calls the tomcat role, I see the following output:

TASK [devops-server : copy tomcat file settings] *********************************
changed: [] => (item={u'dest': u'/etc/logrotate.d/tomcat7', u'src': u'logrotate-tomcat7', u'mode': 420})
changed: [] => (item={u'dest': u'/var/lib/tomcat7/webapps', u'src': u'keystore.pks', u'mode': 420})
changed: [] => (item={u'dest': u'/etc/tomcat7', u'src': u'jmxremote.access', u'mode': 420})
failed: [] (item={u'dest': u'/etc/tomcat7', u'src': u'jmxremote.password', u'mode': 384}) => {"checksum": "2203ad1530a3bc06732043ba67d129b5364505ce", "details": "bad symbolic permission for mode: 384", "failed": true, "gid": 91, "group": "tomcat", "item": {"dest": "/etc/tomcat7", "mode": 384, "src": "jmxremote.password"}, "mode": "0644", "msg": "mode must be in octal or symbolic form", "owner": "tomcat", "path": "/etc/tomcat7/jmxremote.password", "size": 52, "state": "file", "uid": 91}

Obviously, mode 0600 works on the command line of my EC2 instance:

ec2-user@devops-01 ~]$ sudo chmod 0600 /etc/tomcat7/jmxremote.password
ec2-user@devops-01 ~]$ ls -l /etc/tomcat7/jmxremote.password
-rw------- 1 tomcat tomcat 52 Oct 28 16:18 /etc/tomcat7/jmxremote.password

So what gives? Is this an Ansible bug or am I missing something?

  • Do the other three files get installed with the correct permissions (rw-r--r--)? – Paul Haldane Oct 28 '16 at 16:45
  • @PaulHaldane Good point, and a good clue towards the source of the problem. The other files have -r---w---- which is obviously as incorrect as the file causing me grief right now. Never bothered to check their permissions because it wasn't important for those files. – LegendaryDude Oct 28 '16 at 17:37

This is obviously a bug in Ansible. To me the code seems fine. According to this GitHub Issue the error can be worked around by setting the octal for modeas a string. Like this: 0644 "0644"

So I would try this:

 - { src: logrotate-tomcat7, dest: /etc/logrotate.d/tomcat7, mode: "0644" }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.