Q1. If you setup root with a restrictive umask, it will affect the files created when you run ansible, right? (Unless you tell ansible to ensure a specific mode aka. permissions).

A1. Looks like it, ansible does not automatically reset the umask.

Q2. What can we conclude from this?

  1. Is there a way to write ansible roles that they will never depend on the umask?
  2. Are there disadvantages of writing an ansible role to work under this constraint?

1 Answer 1


Ansible now answers this question by adding a umask option, to modules like the ones mentioned, which create files without a specific mode.

I don't see a big disadvantage if you add this more explicit option where appropriate. Maybe just a small annoyance when reading the role.

I note the copy module does not implement umask. You can specify mode, it's just that this has slightly different semantics. If you could specify umask, and the file already existed (regardless of content), then its mode would not be changed. (In the role I'm working on, I think it's useful that the copy module made me think about this).

I note that the original message mentions pip breaking permissions on the ansible install under /usr/lib/python2.6/site-packages. Surely this would also be an issue with running pip manually. It sounds like a defect in pip... but unlike OS packages, pip packages can also be installed inside a virtualenv, so it is much more complex for pip to determine the user's intention. Arguably it is more of an example of a potentially unanticipated issue from using a restrictive umask.

  • 2
    In Ansible 2.2 the command module doesn't appear to have a umask option; you can change command: foo into shell: umask 022 ; foo as a work-around.
    – bjnord
    Commented Sep 11, 2017 at 13:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .