{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/5397","repository_url":"https://api.github.com/repos/hashicorp/terraform","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/5397/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/5397/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/5397/events","html_url":"https://github.com/hashicorp/terraform/issues/5397","id":137603472,"number":5397,"title":"remote-exec provisioner fails with 'bash: Permission denied'","user":{"login":"marionettist","id":17175760,"avatar_url":"https://avatars.githubusercontent.com/u/17175760?v=3","gravatar_id":"","url":"https://api.github.com/users/marionettist","html_url":"https://github.com/marionettist","followers_url":"https://api.github.com/users/marionettist/followers","following_url":"https://api.github.com/users/marionettist/following{/other_user}","gists_url":"https://api.github.com/users/marionettist/gists{/gist_id}","starred_url":"https://api.github.com/users/marionettist/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marionettist/subscriptions","organizations_url":"https://api.github.com/users/marionettist/orgs","repos_url":"https://api.github.com/users/marionettist/repos","events_url":"https://api.github.com/users/marionettist/events{/privacy}","received_events_url":"https://api.github.com/users/marionettist/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-01T15:24:26Z","updated_at":"2016-03-01T16:22:54Z","closed_at":null,"body":"I'm trying to provision a RHEL 7 EC2 instance on AWS and kick off a script using the remote-exec provisioner.\r\n\r\nAfter ssh successfully connects, remote-exec fails with a 'Bash: Permission denied' error as shown in the following log extract:\r\n```\r\naws_instance.jenkins_slave (remote-exec):   Host: ***.***.***.***\r\naws_instance.jenkins_slave (remote-exec):   User: ec2-user\r\naws_instance.jenkins_slave (remote-exec):   Password: false\r\naws_instance.jenkins_slave (remote-exec):   Private key: true\r\naws_instance.jenkins_slave (remote-exec):   SSH Agent: false\r\n←[0m←[0maws_instance.jenkins_slave (remote-exec): Connected!\r\n←[0m←[0maws_instance.jenkins_slave (remote-exec): bash: /tmp/terraform_1298498081.sh: Permission denied\r\n←[31mError applying plan:\r\n\r\n1 error(s) occurred:\r\n\r\n* Script exited with non-zero exit status: 126\r\n```\r\n\r\nThe sample remote-exec I'm using for debugging is very simple:\r\n```\r\n\tprovisioner \"remote-exec\" {\r\n        inline = \"whoami > /tmp/whoami.txt\"\r\n    }\r\n```\r\n\r\nThe issue occurred with Terraform v0.6.6 and v0.6.12. I'm running Terraform from Win 7.\r\n\r\nThe AMI used to create the EC2 instance has been hardened with the recommendations from [Center for Internet Security](https://www.cisecurity.org/), more specifically [CIS Red Hat Enterprise Linux 7 Benchmark](https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_7_Benchmark_v1.0.0.pdf)\r\n\r\nPart of the hardening process sets the noexec option for the /tmp partition, which prevents scripts being run from /tmp.\r\n\r\nCurrently, Terraform generates a temporary script from the information in the Terraform file. It then copies it to /tmp using scp and does a chmod to 777 to allow everyone to read and execute it.\r\n\r\nIf finally tries to execute it by calling it directly, e.g. `/tmp/terraform_1298498081.sh` in the example above.\r\n\r\nTrying to run the script fails because of the noexec option of the file system the script resides on.\r\n\r\nHowever, it is possible to read the file, and `/bin/sh /tmp/terraform_1298498081.sh` works.\r\n\r\nSo can you please amend the Terraform code to run the script using ssh by calling `/bin/sh /tmp/generated_script.sh` instead of `/tmp/generated_script.sh`?\r\n\r\nThanks\r\nNico"},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/190793340","html_url":"https://github.com/hashicorp/terraform/issues/5397#issuecomment-190793340","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/5397","id":190793340,"user":{"login":"apparentlymart","id":20180,"avatar_url":"https://avatars.githubusercontent.com/u/20180?v=3","gravatar_id":"","url":"https://api.github.com/users/apparentlymart","html_url":"https://github.com/apparentlymart","followers_url":"https://api.github.com/users/apparentlymart/followers","following_url":"https://api.github.com/users/apparentlymart/following{/other_user}","gists_url":"https://api.github.com/users/apparentlymart/gists{/gist_id}","starred_url":"https://api.github.com/users/apparentlymart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apparentlymart/subscriptions","organizations_url":"https://api.github.com/users/apparentlymart/orgs","repos_url":"https://api.github.com/users/apparentlymart/repos","events_url":"https://api.github.com/users/apparentlymart/events{/privacy}","received_events_url":"https://api.github.com/users/apparentlymart/received_events","type":"User","site_admin":false},"created_at":"2016-03-01T16:22:54Z","updated_at":"2016-03-01T16:22:54Z","body":"Currently it is possible to upload a script with a different interpreter, like `#!/usr/bin/perl`. That wouldn't be possible if Terraform forced the interpreter to be `/bin/sh`. This would also prevent (for example) using `bash` on a system where `/bin/sh` is `dash`.\r\n\r\nPerhaps we could address this instead by a new `interpreter` argument on the provisioner. If it isn't set then the current behavior would be preserved, requiring that the script be executable. If it *is* set then Terraform would run the script as if it had a `#!` line referring to the given interpreter, so the script wouldn't need to be executable unless the interpreter itself required it.\r\n\r\n```js\r\nprovisioner \"remote-exec\" {\r\n    inline = \"whoami > /tmp/whoami.txt\"\r\n    interpreter = \"/bin/sh\"\r\n}\r\n```\r\n\r\nDo you think that would solve your problem?"}}