65

In ansible, I can do this:

file: dest=/foo/bar/somedir owner=root group=apache mode=0775 recurse=yes

And it recursively sets the owner, group, and permissions to 0775 on all directories and files in that path. But I want to set directories to 0775, and files to 0664. Is there some way to make ansible do this?

52
file: dest=/foo/bar/somedir owner=root group=apache mode=u=rwX,g=rX,o=rX recurse=yes

will set directories to 755, and files to 644.

| improve this answer | |
  • 1
    this does not work for files. – mirza May 22 '18 at 18:14
  • 2
    @Adam Chance Where is the magic? How does specifying u,g,o make it different than the number (and where is 644 written?) – linuxbandit Jul 12 '18 at 9:04
  • 5
    The source code mentions that the symbolic u.g.o handling is the same as "man chmod"'s handling -- capital X has special handling based on the dir/file status and existing execute bits. github.com/ansible/ansible/blob/… – Marc Tamsky Jul 16 '18 at 16:47
  • 5
    In other words, X is x for directories, and nothing for files. And that's how chmod, not ansible treats the mode string. I wish S would be treated likewise. – x-yuri Jan 24 '19 at 12:02
  • 2
    But do note, that it makes files executable by owner executable by all. – x-yuri Jan 24 '19 at 16:35
28

The Ansible file/copy modules don't give you the granularity of specifying permissions based on file type so you'd most likely need to do this manually by doing something along these lines:

- name: Ensure directories are 0755
  command: find {{ path }} -type d -exec chmod 0755 {} \;

- name: Ensure files are 0644
  command: find {{ path }} -type f -exec chmod 0644 {} \;

These would have the effect of recursing through {{ path }} and changing the permissions of every file or directory to the specified permissions.

Source: https://stackoverflow.com/a/28782805/1306186

| improve this answer | |
10

If you want to use the module file in ansible, you can:

file: dest=/foo/bar/somedir owner=root group=apache mode=0644 recurse=yes

file: dest=/foo/bar/somedir owner=root group=apache mode=0775

With this method you first set all the file (recurse=yes) to '644' and then you set /foo/bar/somedir to '775'.

This is not perfect because it will change your directory permission each time you play your playbook. But at least it is idempotent, not like the module command.

If you don't want to have 'changed' status, you can use the module stat. It will list all the files and directory in /foo/bar/somedir so you register the answer and then make a loop on those files only.

| improve this answer | |
  • 7
    Your answer will set all subfiles and subdirectories to 644, while setting only the top-level directory to 775. The need is for all directories to be 775, including subdirectories. – Edward Ned Harvey Sep 15 '16 at 23:38
  • This suggestion is not idempotent. Setting permissions first to one value, and later to another, means that the permissions will be changed on every run. – Kevin Keane Apr 29 '19 at 21:51
5

I'm not sure how much sense it would be to set directories to 0775 (rwxrwxr-x) and files to 0644 (rw-r--r--): group-writeable directories but not files?

If you meant to set files to 0664 (rw-rw-r--) to ensure that files are not executable while directories are traversable then there is an elegant solution involving only one chmod command:

chmod -c -R ug=rw,o=r,a-x+X "{{top_dir}}"

Here is how it can be used in Ansible:

- name: recursive chmod example
  command: |
    chmod -c -R ug=rw,o=r,a-x+X "{{item}}"
  register: chmod_status
  changed_when: chmod_status.stdout != ""
  with_items:
    - "/home/user/sample/dir"

chmod -c prints all the changes that we can conveniently use to populate "changed" status in Ansible. I hope it make sense.

| improve this answer | |
4

To only change mods when needed:

- name: make dirs 0755   
  command: find {{ your_path }} -type d ! -perm 0755 -exec chmod 0755 {} \;

- name: make files 0644   
  command: find {{ your_path }} -type f ! -perm 0644 -exec chmod 0644 {} \;
| improve this answer | |
1

A more modern approach would be to first filter out the dirs like so:

  - name: Evaluating home dirs    
    find:    
      path: "/home"    
      file_type: "directory"    
    register: homedirs    

  # This returns the actual dir-path's 
  - set_fact: 
      homes: "{{ homedirs.files | map(attribute='path') | list }}"           

  - name: Changing permissions of /home/*
    file:    
      path: "{{ item }}"  
      mode: 0700  
    with_items:    
      - "{{ homes }}"

NOTE: Change "file_type" parameter to "file", for files to be affected

| improve this answer | |
0

As an example, as if "securing" a hypothetical Joomla! instance:

- name: Ensure to secure the Joomla installation
  shell: "find . -type d -exec chmod 755 {} \\; && find . -type f -exec chmod 644 {} \\; && chown -R www-data: cache modules images media modules logs tmp administrator/cache"
  args:
      chdir: "{{ production_backend_root_path }}"
  tags: 
      - joomla_secure

Where root owns all but a few designated directories owned by the webserver.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.