Yq: cannot open files with sudo

[gildas]

Seems like opening a "root-only" file does not work with sudo.

E.g.:

$ sudo yq r /etc/netplan/50-cloud-init.yaml network.version
open /etc/netplan/50-cloud-init.yaml: permission denied

[mikefarah]

I can't replicate this - can you double check that you can 'cat' the file?

[gildas]

Well, no I cannot cat the file. But if I sudo cat the file, I can.

[mikefarah]

yes sorry I meant sudo :P

Tried this locally and it works for me :| what are the permissions of the file exactly?

As a work around, you may be able to

sudo cat file | yq r - network.version

[mikefarah]

Closing this - haven't heard anything and no one else has reported a similar issue.

[jeking3]

I am seeing this after using "snap install yq":

jking@dvm:~/tutools$ yq r catalog.yml cloud-init-x64.sha256
a18c19ed5b462bd5728f5789c51b41e3f5436c27f103bad921c1822cfb723d5b
jking@dvm:~/tutools$ sudo yq r catalog.yml cloud-init-x64.sha256
Error: open catalog.yml: permission denied
Usage:
  yq read [yaml_file] [path] [flags]

Aliases:
  read, r

Examples:

yq read things.yaml a.b.c
yq r - a.b.c (reads from stdin)
yq r things.yaml a.*.c
yq r -d1 things.yaml a.array[0].blah
yq r things.yaml a.array[*].blah


Flags:
  -d, --doc string   process document index number (0 based, * for all documents) (default "0")
  -h, --help         help for read
  -j, --tojson       output as json

Global Flags:
  -t, --trim      trim yaml output (default true)
  -v, --verbose   verbose mode

12:31:12 main [ERRO] open catalog.yml: permission denied
jking@dvm:~/tutools$ sudo yq r /home/jking/tutools/catalog.yml cloud-init-x64.sha256
Error: open /home/jking/tutools/catalog.yml: permission denied
Usage:
  yq read [yaml_file] [path] [flags]

Aliases:
  read, r

Examples:

yq read things.yaml a.b.c
yq r - a.b.c (reads from stdin)
yq r things.yaml a.*.c
yq r -d1 things.yaml a.array[0].blah
yq r things.yaml a.array[*].blah


Flags:
  -d, --doc string   process document index number (0 based, * for all documents) (default "0")
  -h, --help         help for read
  -j, --tojson       output as json

Global Flags:
  -t, --trim      trim yaml output (default true)
  -v, --verbose   verbose mode

12:31:27 main [ERRO] open /home/jking/tutools/catalog.yml: permission denied
jking@dvm:~/tutools$ ls -ls catalog.yml
4 -rw-rw-r-- 1 jking jking 659 Oct 16 12:09 catalog.yml

[skrussell]

@jeking3 - I know this is an old post, but I've just run up against the same issue; the problem is the snap sandbox.

As this bug report is pretty much the only search result for this problem, I'll post this here anyway:
The solution is to remove the sandboxed version and re-install the classic app version: snap remove yq && snap install yq --classic

Hope that helps someone.

[jeking3]

@mikefarah this should be reopened.

[huangtianhua]

I can reproduced this problem no matter with/without sudo, how I can resolve this?

[mikefarah]

Done some digging - this is a snapcraft confinement issue (https://docs.snapcraft.io/snap-confinement/6233), currently yq has 'strict' confinement and it really needs 'classic'.

I can't actually set it to 'classic' myself, I have to raise a forum request and get an admin to allow it, which I have done so here: https://forum.snapcraft.io/t/requesting-classic-confinement-for-yq/10559

[mikefarah]

btw - as a workaround if you install yq from the github release binaries then it should work...

[mikefarah]

Looks like this is they way snap is intended to work.

I've added some 'snap' specific instructions on how to access root files to the project readme as per the issue in the snapcraft forum

[MaurGi]

still reproing for me right now

[pkandarpa-cs]

Same

[Nenzyz]

Please check apparmor settings on the system.
Haven't figured out how to proceed yet, but dmesg shows that yq was denied.

[robstoll]

Same here, tried to install with --classic but seems like it is still installed as strict

[jessehu]

Hi @mikefarah can we remove the guide for snap install yq in README.md if it doesn't work as described in this ticket?

[falloutphil]

The instructions aren't quite right for the workaround (https://mikefarah.gitbook.io/yq/ under "Snap notes"):

sudo cat /etc/myfile | yq -r - somecommand

The is no -r flag.

Also the issue doesn't just occur with explicit sudo like this. If you sudo to another user's account or non-interactive accounts (eg jenkins) also see the problem when running scripts with yq.

I use the following workaround:

yq <command> - <path_expression> <new value> < input.yaml

So replace input.yaml with "-" to take stdin pipe as input and then use the redirection operator at the end of the expression.

[mikefarah]

Thanks @falloutphil I've fixed the docs.

Are the snap workaround instructions working? As far as I can tell, in principal, they should. Basically snap doesn't let yq have sudo access - so you need to pipe in restricted fiel (or fiels from another account).

I guess if snap is more trouble than it's worth for folks I can remove the snap build entirely shrug