sudo (install Az) creates user .Azure directory which user can't access

Open

#9,078 opened on Apr 24, 2019 17 comments 0 reactions 1 assignee Claimed by @wyunchi-ms View on GitHub

Azure PS Team customer-reported P0 Ramp Up

Dominant language: C#
Stars: 4.8k
Forks: 4.3k
Avg merge: 3d 14h
Merged PRs (30d): 54

Description

## Description
Installing the Az module on Linux within `sudo` (to complete a global install) creates an `~user/.Azure` directory owned by `root`. Subsequently the user account cannot access files in the directory, causing errors connecting to Azure.

This problem did not exist before 4/8. I suspect that a new version of Az was released on 4/8, causing this regression.

I have provided complete details on my problem, with repro steps, here:
https://developercommunity.visualstudio.com/content/problem/523218/azure-powershell-script-new-error-there-was-an-err.html

## Steps to reproduce
This bug originally bit me while installing Az on an Ubuntu 16.04 build agent in Azure DevOps, though I would expect this issue to affect all Linux users.

To install Az on an Ubuntu 16.04 build agent, I use the bash command:

```bash
sudo /usr/bin/pwsh -NoLogo -NoProfile -NonInteractive -Command . '$(Build.Repository.LocalPath)/build/install-az-modules.ps1'
```

The `build/install-az-modules.ps1` script is:
```powershell
<#
.SYNOPSIS
Build agent script to install Az Powershell modules. This script should be run as sudo.

On a linux build agent, this command can be run as:
sudo /usr/bin/pwsh -NoLogo -NoProfile -NonInteractive -Command . '$(Build.Repository.LocalPath)/build/install-az-modules.ps1'
#>

# Disable status info to clean up build agent stdout
$global:ProgressPreference = 'SilentlyContinue'
$global:VerbosePreference = "SilentlyContinue"

$azureRmModule = Get-InstalledModule AzureRM -ErrorAction SilentlyContinue
if ($azureRmModule) {
Write-Host 'AzureRM module exists. Removing it'
Uninstall-Module -Name AzureRM -AllVersions
Write-Host 'AzureRM module removed'
}

Write-Host '##[section]Installing Az module...'
Install-Module Az -Force -AllowClobber

if (Get-Command Uninstall-AzureRm -ErrorAction SilentlyContinue) {
Write-Host 'Running Uninstall-AzureRm...'
Uninstall-AzureRm
}
```

After running this script (again, within sudo - I'm not aware of a better way to install Az globally, and remove AzureRm globally), the following command fails:

```
PS> Connect-AzAccount (valid connect params)
Connect-AzAccount : Access to the path '/home/vsts/.Azure/AzureRmContext.json' is denied.
At /home/vsts/work/_temp/f5c95a72-dda3-4178-babd-7a26eef54735.ps1:5 char:1
+ Connect-AzAccount -ServicePrincipal -TenantId edb5bc34-4649-4523-84b ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [Connect-AzAccount], UnauthorizedAccessException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand
```

## Environment data

```
Name Value
---- -----
PSVersion 6.2.0
PSEdition Core
GitCommitId 6.2.0
OS Linux 4.15.0-1041-azure #45-Ubuntu SMP Fri Mar …
Platform Unix
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

## Module versions

```powershell
Directory: /home/vsts/.local/share/powershell/Modules

ModuleType Version Name

---------- -------
Script 1.5.1
Script 1.0.1
Script 1.1.0
Script 1.0.0
Script 1.0.0
Script 1.2.1
Script 1.1.0
Script 1.0.0
Script 1.2.0
Script 1.1.0
Script 1.8.0
Script 1.0.1
Script 1.0.1
Script 1.1.1
Script 1.0.0
Script 1.2.0
Script 1.0.0
Script 1.0.0
Script 1.1.1
Script 1.1.0
Script 1.1.0
Script 1.1.0
Script 1.2.0
Script 1.2.1
Script 1.1.0
Script 1.0.0
Script 1.1.0
Script 1.1.0
Script 1.7.0
Script 1.1.0
Script 1.2.0
Script 1.0.0
Script 1.1.0
Script 1.3.0
Script 1.1.0
Script 1.0.0
Script 1.3.1
Script 1.0.0
Script 1.0.1
Script 1.0.2
Script 1.9.0
Script 1.2.0
Script 1.0.0
Script 1.0.1
Script 1.2.0
``` PSEdition ExportedCom mands ---- --------- ----------- Az.Accounts Core,Desk {Disable-A… Az.Aks Core,Desk {Get-AzAks… Az.AnalysisServices Core,Desk {Resume-Az… Az.ApiManagement Core,Desk {Add-AzApi… Az.ApplicationInsights Core,Desk {Get-AzApp… Az.Automation Core,Desk {Get-AzAut… Az.Batch Core,Desk {Remove-Az… Az.Billing Core,Desk {Get-AzBil… Az.Cdn Core,Desk {Get-AzCdn… Az.CognitiveServices Core,Desk {Get-AzCog… Az.Compute Core,Desk {Remove-Az… Az.ContainerInstance Core,Desk {New-AzCon… Az.ContainerRegistry Core,Desk {New-AzCon… Az.DataFactory Core,Desk {Set-AzDat… Az.DataLakeAnalytics Core,Desk {Get-AzDat… Az.DataLakeStore Core,Desk {Get-AzDat… Az.DevTestLabs Core,Desk {Get-AzDtl… Az.Dns Core,Desk {Get-AzDns… Az.EventGrid Core,Desk {New-AzEve… Az.EventHub Core,Desk {New-AzEve… Az.HDInsight Core,Desk {Get-AzHDI… Az.IotHub Core,Desk {Add-AzIot… Az.KeyVault Core,Desk {Add-AzKey… Az.LogicApp Core,Desk {Get-AzInt… Az.MachineLearning Core,Desk {Move-AzMl… Az.MarketplaceOrdering Core,Desk {Get-AzMar… Az.Media Core,Desk {Sync-AzMe… Az.Monitor Core,Desk {Get-AzMet… Az.Network Core,Desk {Add-AzApp… Az.NotificationHubs Core,Desk {Get-AzNot… Az.OperationalInsights Core,Desk {New-AzOpe… Az.PolicyInsights Core,Desk {Get-AzPol… Az.PowerBIEmbedded Core,Desk {Remove-Az… Az.RecoveryServices Core,Desk {Get-AzRec… Az.RedisCache Core,Desk {Remove-Az… Az.Relay Core,Desk {New-AzRel… Az.Resources Core,Desk {Get-AzPro… Az.ServiceBus Core,Desk {New-AzSer… Az.ServiceFabric Core,Desk {Add-AzSer… Az.SignalR Core,Desk {New-AzSig… Az.Sql Core,Desk {Get-AzSql… Az.Storage Core,Desk {Get-AzSto… Az.StreamAnalytics Core,Desk {Get-AzStr… Az.TrafficManager Core,Desk {Add-AzTra… Az.Websites Core,Desk {Get-AzApp…

## Debug output

```
##[command]Connect-AzAccount (args)
DEBUG: 8:40:17 PM - ConnectAzureRmAccountCommand begin processing with ParameterSet 'ServicePrincipalCertificateWithSubscriptionId'.
DEBUG: 8:40:17 PM - Autosave setting from startup session: 'CurrentUser'
DEBUG: 8:40:17 PM - No autosave setting detected in environment variable 'AzContextAutoSave'.
DEBUG: 8:40:17 PM - Using Autosave scope 'CurrentUser'
DEBUG: [Common.Authentication]: Authenticating using configuration values: Domain: 'edb5bc34-4649-4523-84bb-e974adad42ec', Endpoint: 'https://login.microsoftonline.com/', ClientId: '1950a258-227b-4e31-a9cf-717495945fc2', ClientRedirect: 'urn:ietf:wg:oauth:2.0:oob', ResourceClientUri: 'https://management.core.windows.net/', ValidateAuthority: 'True'
DEBUG: [ADAL]: Information: 2019-04-24T20:40:17.7401267Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: ADAL PCL.CoreCLR with assembly version '3.19.2.6005', file version '3.19.50302.0130' and informational version '2a8bec6c4c76d0c1ef819b55bdc3cda2d2605056' is running...

DEBUG: [ADAL]: Information: 2019-04-24T20:40:17.7412832Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: === Token Acquisition started:
CacheType: null
Authentication Target: Client
, Authority Host: login.microsoftonline.com

DEBUG: [ADAL]: Verbose: 2019-04-24T20:40:18.3329526Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: Loading from cache.

DEBUG: [ADAL]: Verbose: 2019-04-24T20:40:18.3427860Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: Looking up cache for a token...

DEBUG: [ADAL]: Information: 2019-04-24T20:40:18.3502347Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: No matching token was found in the cache

DEBUG: [ADAL]: Verbose: 2019-04-24T20:40:18.3505894Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: Looking up cache for a token...

DEBUG: [ADAL]: Information: 2019-04-24T20:40:18.3509554Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: No matching token was found in the cache

DEBUG: [ADAL]: Verbose: 2019-04-24T20:40:18.3513003Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: Looking up cache for a token...

DEBUG: [ADAL]: Information: 2019-04-24T20:40:18.3516026Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: No matching token was found in the cache

DEBUG: [ADAL]: Verbose: 2019-04-24T20:40:18.3519131Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: Looking up cache for a token...

DEBUG: [ADAL]: Information: 2019-04-24T20:40:18.3522751Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: No matching token was found in the cache

DEBUG: [ADAL]: Verbose: 2019-04-24T20:40:18.3526251Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: Looking up cache for a token...

DEBUG: [ADAL]: Information: 2019-04-24T20:40:18.3530887Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: No matching token was found in the cache

DEBUG: [ADAL]: Verbose: 2019-04-24T20:40:18.3534393Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: Looking up cache for a token...

DEBUG: [ADAL]: Information: 2019-04-24T20:40:18.3537700Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: No matching token was found in the cache

DEBUG: [ADAL]: Verbose: 2019-04-24T20:40:18.6168753Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: Storing token in the cache...

DEBUG: [ADAL]: Verbose: 2019-04-24T20:40:18.6179255Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: An item was stored in the cache

DEBUG: [ADAL]: Information: 2019-04-24T20:40:18.6192248Z: 9dc1a508-38af-4c72-8627-220c3baefb5b - LoggerBase.cs: === Token Acquisition finished successfully. An access token was returned: Expiration Time: 4/24/19 9:40:18 PM +00:00

DEBUG: [ADAL]: Information: 2019-04-24T20:40:18.6194496Z: 00000000-0000-0000-0000-000000000000 - LoggerBase.cs: Serializing token cache with 1 items.

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions?api-version=2016-06-01

Headers:
x-ms-client-request-id : 87a31554-82d5-44eb-9987-fda27b764e93
Accept-Language : en-US

Body:

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Cache-Control : no-cache
Pragma : no-cache
x-ms-ratelimit-remaining-tenant-reads: 11999
x-ms-request-id : fae216fa-0bc5-4c18-b780-97f442271d28
x-ms-correlation-request-id : fae216fa-0bc5-4c18-b780-97f442271d28
x-ms-routing-request-id : WESTUS2:20190424T204019Z:fae216fa-0bc5-4c18-b780-97f442271d28
Strict-Transport-Security : max-age=31536000; includeSubDomains
X-Content-Type-Options : nosniff
Date : Wed, 24 Apr 2019 20:40:18 GMT

Body:
{
"value": [
{
"id": "/subscriptions/???",
"subscriptionId": "???",
"displayName": "Visual Studio Enterprise",
"state": "Enabled",
"subscriptionPolicies": {
"locationPlacementId": "Public_2014-09-01",
"quotaId": "MSDN_2014-09-01",
"spendingLimit": "On"
},
"authorizationSource": "RoleBased"
}
]
}

Connect-AzAccount : Access to the path '/home/vsts/.Azure/AzureRmContext.json' is denied.
At /home/vsts/work/_temp/273d11e7-8f56-45dd-82f1-19513d425467.ps1:9 char:1
+ Connect-AzAccount -ServicePrincipal -TenantId ??? ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [Connect-AzAccount], UnauthorizedAccessException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand

DEBUG: AzureQoSEvent: CommandName - Connect-AzAccount; IsSuccess - False; Duration - 00:00:01.2534094; Exception - System.UnauthorizedAccessException: Access to the path '/home/vsts/.Azure/AzureRmContext.json' is denied. ---> System.IO.IOException: Permission denied
--- End of inner exception stack trace ---
at Interop.ThrowExceptionForIoErrno(ErrorInfo errorInfo, String path, Boolean isDirectory, Func`2 errorRewriter)
at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String path, OpenFlags flags, Int32 mode)
at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
at System.IO.File.Open(String path, FileMode mode, FileAccess access, FileShare share)
at Microsoft.Azure.Commands.Common.Authentication.Abstractions.DiskDataStore.OpenForExclusiveWrite(String path)
at Microsoft.Azure.Commands.Common.Authentication.ResourceManager.ProtectedFileProvider.ExclusiveWriteFileProvider.AcquireLock(String filePath)
at Microsoft.Azure.Commands.Common.Authentication.ResourceManager.ProtectedFileProvider.TryGetStreamLock(Func`2 acquireLock, String filePath, Stream& stream)
at Microsoft.Azure.Commands.Common.Authentication.ResourceManager.ProtectedFileProvider.InitializeStream()
at Microsoft.Azure.Commands.Common.Authentication.ResourceManager.ProtectedFileProvider.get_Stream()
at Microsoft.Azure.Commands.Common.Authentication.ResourceManager.ProtectedFileProvider.CreateReader()
at Microsoft.Azure.Commands.Common.Authentication.Models.AzureRmProfile.Load(IFileProvider provider)
at Microsoft.Azure.Commands.Common.Authentication.Models.AzureRmProfile..ctor(IFileProvider provider)
at Microsoft.Azure.Commands.Common.Authentication.ResourceManager.AzureRmAutosaveProfile.get_DefaultProfile()
at Microsoft.Azure.Commands.Common.Authentication.ResourceManager.AzureRmAutosaveProfile.TrySetDefaultContext(IAzureContext context)
at Microsoft.Azure.Commands.Common.Authentication.ResourceManager.AzureRmAutosaveProfile.TrySetDefaultContext(String name, IAzureContext context)
at Microsoft.Azure.Commands.ResourceManager.Common.RMProfileClient.Login(IAzureAccount account, IAzureEnvironment environment, String tenantId, String subscriptionId, String subscriptionName, SecureString password, Boolean skipValidation, Action`1 promptAction, String name, Boolean shouldPopulateContextList)
at Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand.<>c__DisplayClass92_0.b__0(AzureRmProfile localProfile, RMProfileClient profileClient, String name)
at Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand.<>c__DisplayClass94_0.b__0(AzureRmProfile prof, RMProfileClient client)
at Microsoft.Azure.Commands.Profile.Common.AzureContextModificationCmdlet.ModifyContext(Action`2 contextAction)
at Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand.SetContextWithOverwritePrompt(Action`3 setContextAction)
at Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand.ExecuteCmdlet()
at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.<>c__3`1.b__3_0(T c)
at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet, Action`1 executor)
at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet)
at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord();
DEBUG: Finish sending metric.
DEBUG: 8:42:30 PM - ConnectAzureRmAccountCommand end processing.
DEBUG: 8:42:30 PM - ConnectAzureRmAccountCommand end processing.
```

## Workaround

The workaround is to delete the `~user/.Azure` directory after installing the Az module, eg:

```bash
sudo rm -rf ~/.Azure
```

After doing this, the directory is properly recreated after running Az commands as user.

However, it's still a bug (and a new bug) that root owns `~user/.Azure` after the install.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

sudo (install Az) creates user .Azure directory which user can't access

Description

Contributor guide

Assessment

Get new issues in your inbox