freeipa

#8902 ipareplica install fails with "msg: 'Unexpected system mask: 0077, expected 0022'" error
Closed: invalid by rjeffman. Opened by sslamat.

Closed: invalid
Reopen Issue

Request for enhancement

Need to add an force/overwrite option so the task can proceed if UMASK has different value.

Issue

Get a fatal error when running ansible playbook
TASK [ipareplica : Install - Replica installation test] ********************
fatal: [localhost]: FAILED! => changed=false
msg: 'Unexpected system mask: 0077, expected 0022'

Our current permission mask is set to 077 and this is a security requirement (cannot change).
UMASK 077

Is it possible to add an option to force this task to continue if the UMASK is not '0022'?
https://github.com/freeipa/freeipa/blob/master/ipaserver/install/server/replicainstall.py#L579

Steps to Reproduce

  1. Change UMASK to 077 in /etc/login.defs
  2. Run ansible-playbook to install ipareplica.

Actual behavior

The playbook fails.

Expected behavior

The playbook should install ipareplica.

Version/Release/Distribution

ipa-server-4.8.4-7.module+el8.2.0+6046+aaa49f96.x86_64

Additional info:

None.

When run interactively the user is asked if they want to continue anyway with a mask known to have problems.

If you want to file a ticket against the ansible-freeipa module that project is at https://github.com/freeipa/ansible-freeipa

Metadata Update from @rcritten:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)

Our process is automated and we run ansible playbooks on multiple processors (up to 40) at the same time, so the user can't answer every prompt.

Metadata Update from @sslamat:
- Issue status updated to: Open (was: Closed)

Your issue is with the Ansible module.

@sslamat, please open this issue against ansible-freeipa.

Ok. I'll open it there. Thanks

This is an ansible-freeipa issue, and as it has been open there (issue #588), I'm closing this one.

Metadata Update from @rjeffman:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)

The issue is that common_check in ipaserver/install/server/replicainstall.py does this:

mask_str = validate_mask()
if mask_str:
    raise ScriptError(
        "Unexpected system mask: %s, expected 0022" % mask_str)

common_check is used in ipareplica_test.py in ansible-freeipa.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.