Jira (BOLT-505) PT_xyz env variables do not seem to be propagated when using "run-as"

[Scott Walker (JIRA)]

Title: Message Title

Scott Walker created an issue   Puppet Task Runner / BOLT-505 PT_xyz env variables do not seem to be propagated when using "run-as" Issue Type: Bug Assignee: Unassigned Created: 2018/04/30 4:12 AM Priority: Normal Reporter: Scott Walker It looks like PT_xyz environment variables are not preserved when the "run-as" option is used to escalate to root. Running against CentOS 7 on vmpooler: [root@jj49aizkzelmhma ~]# uname -a Linux jj49aizkzelmhma 3.10.0-514.6.2.el7.x86_64 #1 SMP Thu Feb 23 03:04:39 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux [root@jj49aizkzelmhma ~]# cat /etc/*release CentOS Linux release 7.2.1511 (Core) NAME="CentOS Linux" VERSION="7 (Core)" ID="centos" ID_LIKE="rhel fedora" VERSION_ID="7" PRETTY_NAME="CentOS Linux 7 (Core)" ANSI_COLOR="0;31" CPE_NAME="cpe:/o:centos:centos:7" HOME_URL="https://www.centos.org/" BUG_REPORT_URL="https://bugs.centos.org/"   CENTOS_MANTISBT_PROJECT="CentOS-7" CENTOS_MANTISBT_PROJECT_VERSION="7" REDHAT_SUPPORT_PRODUCT="centos" REDHAT_SUPPORT_PRODUCT_VERSION="7"   CentOS Linux release 7.2.1511 (Core) CentOS Linux release 7.2.1511 (Core) Using the following inventory to specify a low priviledge user foo/foo: BOLT_INVENTORY={"nodes":[{"name":"10.32.121.14","config":{"transport":"ssh","ssh":{"user":"foo","password":"foo","host-key-check":false}}}]} I see the following output running the Linux variant of https://github.com/puppetlabs/puppetlabs-bootstrap: pipeline ᐅ bolt --debug --format json --run-as root task run service::linux --modulepath /Users/scott/task-modules --nodes 10.32.121.14 --params '{"action":"stop","name":"crond"}'   Started with 10 max thread(s) { "items": [ ModuleLoader: module 'boltlib' has unknown dependencies - it will have all other modules visible Starting: task service::linux on 10.32.121.14 Authentication method 'gssapi-with-mic' is not available Running task service::linux with '{"action"=>"stop", "name"=>"crond"}' via environment on ["10.32.121.14"] Running task run 'Task({'name' => 'service::linux', 'executable' => '/Users/scott/task-modules/service/tasks/linux.sh', 'description' => 'Manage the state of services (without a puppet agent)', 'parameters' => {'action' => {'description' => 'The operation (start, stop) to perform on the service', 'type' => Enum['restart', 'start', 'stop']}, 'name' => {'description' => 'The name of the service to operate on.', 'type' => String[1]}}, 'input_method' => 'environment'})' on 10.32.121.14 Opened session Executing: mktemp -d stdout: /tmp/tmp.GfSPwiR1vz   Command returned successfully Executing: chmod u\+x /tmp/tmp.GfSPwiR1vz/linux.sh Command returned successfully Executing: sudo -S -u root -p \[sudo\]\ Bolt\ needs\ to\ run\ as\ another\ user,\ password:\ chown -R root: /tmp/tmp.GfSPwiR1vz Command returned successfully Executing: PT_action=stop PT_name=crond sudo -S -u root -p \[sudo\]\ Bolt\ needs\ to\ run\ as\ another\ user,\ password:\ /tmp/tmp.GfSPwiR1vz/linux.sh stderr: /tmp/tmp.GfSPwiR1vz/linux.sh: line 1: inux.sh:: command not found   stdout: { "status": " " }   Command returned successfully Executing: sudo -S -u root -p \[sudo\]\ Bolt\ needs\ to\ run\ as\ another\ user,\ password:\ rm -rf /tmp/tmp.GfSPwiR1vz Command returned successfully Closed session {"node":"10.32.121.14","status":"success","result":{"status":" "}}{"node":"10.32.121.14","status":"success","result":{"status":" "}}   Finished: task service::linux with 0 failures in 5.06 sec ], "node_count": 1, "elapsed_time": 5 } I think part of the problem is that the task itself is not resilient to these params being unset. I will raise that separately elsewhere. The core problem might be the sudo command executed by bolt which does not specify the -E option to preserve environment meaning the PT_action and PT_name variables are not propagated to the task. Trying it by hand using the same command as bolt: [root@jj49aizkzelmhma ~]# PT_action=stop PT_name=crond sudo -S -u root -p \[sudo\]\ Bolt\ needs\ to\ run\ as\ another\ user,\ password:\ /root/scott.sh { "status": " " } Trying it by hand with the -E sudo option: [root@jj49aizkzelmhma ~]# PT_action=stop PT_name=crond sudo -S -E -u root -p \[sudo\]\ Bolt\ needs\ to\ run\ as\ another\ user,\ password:\ /root/scott.sh { "status": "crond stop" } Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.