title: Ansible: how to deal with files that the current user does not have read permission (mode `0o600`)?
body: <h3>Environment</h3>
  <ul>
  <li>Ubuntu 18.04 Desktop</li>
  <li>Ansible 2.10.0</li>
  <li>Python 3.6.9</li>
  </ul>
  <h3>Brief Description</h3>
  <p>I have a file <code>/tmp/hello.txz</code> that is owned by root and does not allow others to read/write:</p>
  <pre><code>-rw------- 1 root root 176 Mar 11 20:32 hello.txz
  </code></pre>
  <p>When I try to copy it to another location:</p>
  <pre><code>ansible -m copy -K --become -vvv -a &quot;src='/tmp/hello.txz' dest='/tmp/new_location'&quot; localhost
  </code></pre>
  <p>I get the following error:</p>
  <pre><code>localhost | FAILED! =&gt; {
      &quot;msg&quot;: &quot;an error occurred while trying to read the file '/tmp/hello.txz': [Errno 13] Permission denied: b'/tmp/hello.txz'&quot;
  }
  </code></pre>
  <p>When I try to unarchive it:</p>
  <pre><code>ansible -m unarchive -K --become -vvv -a &quot;src='/tmp/hello.txz' dest='/tmp'&quot; localhost
  </code></pre>
  <p>I get the same &quot;Permission denied&quot; error.</p>
  <h3>My Debugging Effort</h3>
  <p>After debugging into the source code, <strong>I think the reasons are as follows</strong>:</p>
  <ol>
  <li>The modules <code>copy</code> and <code>unarchive</code> happen to have their corresponding action plugins: <a href="https://github.com/ansible/ansible/blob/v2.10.0/lib/ansible/plugins/action/copy.py" rel="nofollow noreferrer">copy</a> and <a href="https://github.com/ansible/ansible/blob/v2.10.0/lib/ansible/plugins/action/unarchive.py" rel="nofollow noreferrer">unarchive</a>.</li>
  <li>The action plugins seem to be executed in the current, unprivileged user mode (i.e., prior to <code>become</code>) so it only has whatever permissions the current unprivileged user has.</li>
  <li>But because the file is owned by <code>root</code> and doesn't allow others to read/write, the current, unprivileged user can't deal with the file.</li>
  <li><code>--become</code> seems to work for Ansible modules but not the corresponding action plugins.</li>
  </ol>
  <p>One evidence is that the <code>EXEC</code> commands are not wrapped by <code>sudo</code> (:</p>
  <pre><code>&lt;127.0.0.1&gt; ESTABLISH LOCAL CONNECTION FOR USER: ywen
  &lt;127.0.0.1&gt; EXEC /bin/sh -c 'echo ~ywen &amp;&amp; sleep 0'
  &lt;127.0.0.1&gt; EXEC /bin/sh -c '( umask 77 &amp;&amp; mkdir -p &quot;` echo /home/ywen/.ansible/tmp `&quot;&amp;&amp; mkdir &quot;` echo /home/ywen/.ansible/tmp/ansible-tmp-1615567945.1988397-2230-210988164993075 `&quot; &amp;&amp; echo ansible-tmp-1615567945.1988397-2230-210988164993075=&quot;` echo /home/ywen/.ansible/tmp/ansible-tmp-1615567945.1988397-2230-210988164993075 `&quot; ) &amp;&amp; sleep 0'
  &lt;127.0.0.1&gt; EXEC /bin/sh -c 'rm -f -r /home/ywen/.ansible/tmp/ansible-tmp-1615567945.1988397-2230-210988164993075/ &gt; /dev/null 2&gt;&amp;1 &amp;&amp; sleep 0'
  </code></pre>
  <p>The &quot;Permission denied&quot; error that <code>copy</code> and <code>unarchive</code> report is caused by the <a href="https://github.com/ansible/ansible/blob/v2.10.0/lib/ansible/parsing/dataloader.py#L362-L363" rel="nofollow noreferrer">following <code>with</code> line</a>:</p>
  <pre class="lang-py prettyprint-override"><code>            if decrypt:
                  with open(to_bytes(real_path), 'rb') as f:
  </code></pre>
  <h3>An Unacceptable Workaround</h3>
  <p>To &quot;fix&quot; this issue for me, simply change the file mode from <code>0o600</code> to <code>0o644</code> to give the other users read/write permissions.</p>
  <p>However, this wouldn't work for me. The file I want to deal with contains secrets that only <code>root</code> should be able to see. That's why the file was owned by <code>root</code> and doesn't allow others to read/write.</p>
  <h3>My Questions</h3>
  <ol>
  <li>I believe I should be able to develop a more complex playbook to deal with this kind of file. For example, I may run shell commands or even a small script. <strong>But I'm also wondering if there is an easier and more concise way to deal with this kind of file.</strong></li>
  <li>I guess I'm not the first one that encounters this issue, but I don't seem to find any other posts that talk about this. <strong>Could you post the links if you know any of such discussion?</strong></li>
  </ol>