[PATCH 09/12] linux-mirror: ensure proper ownership for system-level mirrors

From: Daniel Gomez <[email protected]>

When running as root with "sudo make mirror", the mirror repositories and
systemd services are managed at the system level. Previously, several tasks
did not properly escalate privileges, causing ownership and permission issues.

The "Start mirroring" task cloned repositories without privilege escalation,
creating repos owned by the invoking user instead of root. System services
running as root then failed with "dubious ownership" errors when accessing
these user-owned repositories.

All tasks that interact with system-level resources now properly escalate
privileges. The /mirror directory is created with root ownership when running
as root. Mirror repositories are cloned as root using start-mirroring.py, and
service files are generated as root using gen-mirror-files.py. Service and
timer files are copied to /etc/systemd/system/ with root privileges, and
systemd services are enabled and checked with proper privilege escalation.

All modified tasks use become: true with become_method: ansible.builtin.sudo,
following the existing pattern in the playbook. This ensures consistent
ownership throughout the mirror setup. When running as root, /mirror and all
repositories are owned by root, matching the execution context of the system
services.

Generated-by: Claude AI
Signed-off-by: Daniel Gomez <[email protected]>
---
 playbooks/roles/linux-mirror/tasks/main.yml | 40 +++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/playbooks/roles/linux-mirror/tasks/main.yml b/playbooks/roles/linux-mirror/tasks/main.yml
index e90917f3..bd47acd3 100644
--- a/playbooks/roles/linux-mirror/tasks/main.yml
+++ b/playbooks/roles/linux-mirror/tasks/main.yml
@@ -68,7 +68,26 @@
     - install_linux_mirror|bool
   tags: ["mirror"]
 
+- name: Create /mirror directory for system-level mirrors
+  become: true
+  become_flags: "su - -c"
+  become_method: ansible.builtin.sudo
+  ansible.builtin.file:
+    path: /mirror/
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when:
+    - install_linux_mirror|bool
+    - not install_only_git_daemon|bool
+    - ansible_user_id == 'root'
+  tags: ["mirror"]
+
 - name: Start mirroring
+  become: true
+  become_flags: "su - -c"
+  become_method: ansible.builtin.sudo
   delegate_to: localhost
   run_once: true
   ansible.builtin.shell: |
@@ -83,6 +102,9 @@
   tags: ["mirror"]
 
 - name: Generate systemd service and timer unit files
+  become: true
+  become_flags: "su - -c"
+  become_method: ansible.builtin.sudo
   delegate_to: localhost
   run_once: true
   ansible.builtin.shell: |
@@ -113,6 +135,9 @@
     - not install_only_git_daemon|bool
 
 - name: Copy systemd service file to user/system systemd dir
+  become: true
+  become_flags: "su - -c"
+  become_method: ansible.builtin.sudo
   ansible.builtin.copy:
     src: "{{ topdir_path }}/playbooks/roles/linux-mirror/linux-mirror-systemd/{{ item.short_name | regex_replace('/', '-') }}-mirror.service"
     dest: "{{ systemd_dir }}/"
@@ -125,6 +150,9 @@
     - not install_only_git_daemon|bool
 
 - name: Copy systemd timer file to user/system systemd dir
+  become: true
+  become_flags: "su - -c"
+  become_method: ansible.builtin.sudo
   ansible.builtin.copy:
     src: "{{ topdir_path }}/playbooks/roles/linux-mirror/linux-mirror-systemd/{{ item.short_name | regex_replace('/', '-') }}-mirror.timer"
     dest: "{{ systemd_dir }}/"
@@ -137,6 +165,9 @@
     - not install_only_git_daemon|bool
 
 - name: Enable systemd unit for mirror services
+  become: true
+  become_flags: "su - -c"
+  become_method: ansible.builtin.sudo
   ansible.builtin.systemd_service:
     name: "{{ item.short_name | regex_replace('/', '-') }}-mirror.service"
     state: started
@@ -151,6 +182,9 @@
     - not install_only_git_daemon|bool
 
 - name: Enable systemd unit for mirror timers
+  become: true
+  become_flags: "su - -c"
+  become_method: ansible.builtin.sudo
   ansible.builtin.systemd_service:
     name: "{{ item.short_name | regex_replace('/', '-') }}-mirror.timer"
     state: started
@@ -165,6 +199,9 @@
     - not install_only_git_daemon|bool
 
 - name: Check systemd unit status for mirror services
+  become: true
+  become_flags: "su - -c"
+  become_method: ansible.builtin.sudo
   ansible.builtin.systemd_service:
     name: "{{ item.short_name | regex_replace('/', '-') }}-mirror.service"
     scope: "{{ systemd_scope }}"
@@ -186,6 +223,9 @@
     - not install_only_git_daemon|bool
 
 - name: Check systemd unit status for mirror timers
+  become: true
+  become_flags: "su - -c"
+  become_method: ansible.builtin.sudo
   ansible.builtin.systemd_service:
     name: "{{ item.short_name | regex_replace('/', '-') }}-mirror.timer"
     scope: "{{ systemd_scope }}"

-- 
2.51.0