<p dir="auto">From <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/shaharmor/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/shaharmor">@shaharmor</a> on 2016-10-26T11:35:24Z</p>
<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">npm</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.1.2.0"><pre class="notranslate"><code class="notranslate">ansible 2.1.2.0
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="[defaults]
host_key_checking = False

[ssh_connection]
pipelining = True
ssh_args = -o ForwardAgent=yes -o ControlMaster=auto -o ControlPersist=60s
control_path = /tmp/%%h-%%p-%%r"><pre class="notranslate"><code class="notranslate">[defaults]
host_key_checking = False

[ssh_connection]
pipelining = True
ssh_args = -o ForwardAgent=yes -o ControlMaster=auto -o ControlPersist=60s
control_path = /tmp/%%h-%%p-%%r
</code></pre></div>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<p dir="auto">OSX 10.10.5</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">When installing anything with the npm module, its setting the permissions of all the modules files/directories to the user which was used to connect to the remote host, regardless of whether become is set or not.</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<ol dir="auto">
<li>Run the following task</li>
</ol>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="- name: install pm2
  become: yes
  npm:
    name: pm2
    global: yes
    production: yes
    state: present"><pre class="notranslate"><code class="notranslate">- name: install pm2
  become: yes
  npm:
    name: pm2
    global: yes
    production: yes
    state: present
</code></pre></div>
<ol dir="auto">
<li>check permissions on the module directory/files (<code class="notranslate">/usr/lib/node_modules/pm2</code>)</li>
</ol>
<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">Files/directories should have root user permissions</p>
<h5 dir="auto">ACTUAL RESULTS</h5>
<p dir="auto">Files/directories have ssh user permissions</p>
<p dir="auto">Copied from original issue: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="185368492" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible-modules-extras/issues/3291" data-hovercard-type="issue" data-hovercard-url="/ansible/ansible-modules-extras/issues/3291/hovercard" href="https://github.com/ansible/ansible-modules-extras/issues/3291">ansible/ansible-modules-extras#3291</a></p>
<p dir="auto">From <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/akloeber/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/akloeber">@akloeber</a> on 2016-11-11T19:19:21Z</p>
<h5 dir="auto">ISSUE TYPE</h5>
<p dir="auto">Bug Report</p>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">npm module</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.1.1.0"><pre class="notranslate"><code class="notranslate">ansible 2.1.1.0
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="  vars:
    node_branch: '4.x'
    node_version: '4.6.2-1nodesource1~trusty1'

  tasks:
    - name: node | Register NodeSource signing key
      become: true
      apt_key: url=https://deb.nodesource.com/gpgkey/nodesource.gpg.key state=present

    - name: node | Add NodeSource repository
      become: true
      apt_repository: repo='{{item}}' state=present
      with_items:
        - deb https://deb.nodesource.com/node_{{node_branch}} trusty main
        - deb-src https://deb.nodesource.com/node_{{node_branch}} trusty main

    - name: node | Install Node.js
      become: true
      apt: name='nodejs={{node_version}}' update_cache=yes state=present

    - name: node | Install pm2
      become: true
      npm: name=pm2 global=yes version=2.1.4"><pre class="notranslate"><code class="notranslate">  vars:
    node_branch: '4.x'
    node_version: '4.6.2-1nodesource1~trusty1'

  tasks:
    - name: node | Register NodeSource signing key
      become: true
      apt_key: url=https://deb.nodesource.com/gpgkey/nodesource.gpg.key state=present

    - name: node | Add NodeSource repository
      become: true
      apt_repository: repo='{{item}}' state=present
      with_items:
        - deb https://deb.nodesource.com/node_{{node_branch}} trusty main
        - deb-src https://deb.nodesource.com/node_{{node_branch}} trusty main

    - name: node | Install Node.js
      become: true
      apt: name='nodejs={{node_version}}' update_cache=yes state=present

    - name: node | Install pm2
      become: true
      npm: name=pm2 global=yes version=2.1.4
</code></pre></div>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="nodejs v4.6.2 LTS shipping with npm v2.5.11
Mac OS X 10.11.6 (local)
Ubuntu 14.04 LTS (provisioning target)"><pre class="notranslate"><code class="notranslate">nodejs v4.6.2 LTS shipping with npm v2.5.11
Mac OS X 10.11.6 (local)
Ubuntu 14.04 LTS (provisioning target)
</code></pre></div>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">If a module is installed globally the ownership of npm's cache (the <code class="notranslate">.npm</code> folder) after provisioning is not correct which causes subsequent errors and strange behaviors due to wrong permissions on that folder.</p>
<p dir="auto">After provisioning with Ansible's npm module the npm cache is populated at <code class="notranslate">/root/.npm</code> but with ownership <code class="notranslate">deploy:deploy</code> where <code class="notranslate">deploy</code> is the user that is used for SSH-login on the remote machine.</p>
<p dir="auto">As global installation of npm modules requires root privileges <code class="notranslate">become: true</code> is set and causes invocation via <code class="notranslate">sudo</code>. I found out that in these cases Ansible invokes <code class="notranslate">npm</code> via <code class="notranslate">sudo -H ...</code> which causes <code class="notranslate">$HOME</code> to be changed to <code class="notranslate">/root</code>. This might cause population of <code class="notranslate">.npm</code> folder at <code class="notranslate">$HOME/.npm</code> == <code class="notranslate">/root/.npm</code> but with ownership of the user defined by <code class="notranslate">$SUDO_USER</code> which is still <code class="notranslate">deploy</code>.<br>
Unfortunately there is no proper documentation on how npm handles installs via sudo, so this is only a guess from my side.</p>
<p dir="auto">Nevertheless this can also be reproduced manually via <code class="notranslate">deploy:~$ sudo -H npm install -g pm2</code> which causes the same behavior. If the flag <code class="notranslate">-H</code> is omitted everything is fine as the <code class="notranslate">.npm</code> folder gets populated at <code class="notranslate">/home/deploy/.npm</code> with ownership <code class="notranslate">deploy:deploy</code> but I do not see any configuration option for Ansible to influence the parameters for the sudo-invocation.</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<p dir="auto">see above</p>
<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">npm's cache should be populated at <code class="notranslate">/home/deploy/.npm</code> with ownership <code class="notranslate">deploy:deploy</code>.</p>
<h5 dir="auto">ACTUAL RESULTS</h5>
<p dir="auto">npm's cache is populated at <code class="notranslate">/root/.npm</code> with ownership <code class="notranslate">deploy:deploy</code>.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="root:~# ls -la
-rw-------  1 root   root   6893 Nov 11 07:26 .bash_history
-rw-r--r--  1 root   root   3106 Feb 20  2014 .bashrc
drwxr-xr-x  3 deploy deploy 4096 Nov 10 21:01 .npm/
-rw-r--r--  1 root   root    141 Nov  7 19:55 .profile
drwx------  2 root   root   4096 Jul 29 10:00 .ssh/
-rw-------  1 root   root   3787 Nov  9 20:42 .viminfo"><pre class="notranslate"><code class="notranslate">root:~# ls -la
-rw-------  1 root   root   6893 Nov 11 07:26 .bash_history
-rw-r--r--  1 root   root   3106 Feb 20  2014 .bashrc
drwxr-xr-x  3 deploy deploy 4096 Nov 10 21:01 .npm/
-rw-r--r--  1 root   root    141 Nov  7 19:55 .profile
drwx------  2 root   root   4096 Jul 29 10:00 .ssh/
-rw-------  1 root   root   3787 Nov  9 20:42 .viminfo
</code></pre></div>
<p dir="auto">Copied from original issue: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="188830594" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible-modules-extras/issues/3442" data-hovercard-type="issue" data-hovercard-url="/ansible/ansible-modules-extras/issues/3442/hovercard" href="https://github.com/ansible/ansible-modules-extras/issues/3442">ansible/ansible-modules-extras#3442</a></p>