ansible/ansible · error · AnsibleError

Could not read password file {pwd_file!r}.

Error message

Could not read password file {pwd_file!r}.

What it means

Raised as AnsibleError (with the OSError chained via 'from') by CLI.get_password_from_file when the non-executable password file exists but cannot be opened/read: the open(b_pwd_file, 'rb') or .read() raises OSError. This covers permission problems, races where the file disappears between the exists() check and open(), and special files that fail to read.

Source

Thrown at lib/ansible/cli/__init__.py:637

            cmd = [b_pwd_file]

            try:
                p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
            except OSError as e:
                raise AnsibleError("Problem occurred when trying to run the password script %s (%s)."
                                   " If this is not a script, remove the executable bit from the file." % (pwd_file, e))

            stdout, stderr = p.communicate()
            if p.returncode != 0:
                raise AnsibleError("The password script %s returned an error (rc=%s): %s" % (pwd_file, p.returncode, to_text(stderr)))
            secret = stdout

        else:
            try:
                with open(b_pwd_file, "rb") as password_file:
                    secret = password_file.read().strip()
            except OSError as ex:
                raise AnsibleError(f"Could not read password file {pwd_file!r}.") from ex

        secret = secret.strip(b'\r\n')

        if not secret:
            raise AnsibleError('Empty password was provided from file (%s)' % pwd_file)

        return to_text(secret)

    @classmethod
    def cli_executor(cls, args=None):
        if args is None:
            args = sys.argv

        try:
            display.debug("starting run")

            ansible_dir = Path(C.ANSIBLE_HOME).expanduser()
            try:

View on GitHub (pinned to 9cf16a4aca)

Solutions

  1. Check ownership and mode: ls -l <file>; ensure the effective runtime user can read it (chmod 640 + proper group, or chown).
  2. Confirm the runtime user context (whoami / id) matches the file's permissions, especially under sudo, systemd, or containers.
  3. If the error is intermittent in automation, guard against concurrent deletion/recreation of the secret file (write atomically via rename).
  4. Ensure the path is a regular file, not a directory or special device.

Example fix

# before
$ sudo -u ci-runner ansible-playbook site.yml --vault-password-file /home/dev/vault.txt
# Could not read password file '/home/dev/vault.txt'. (PermissionError)

# after
$ chown ci-runner:ci-runner /home/dev/vault.txt   # or chmod 640 with shared group
$ sudo -u ci-runner ansible-playbook site.yml --vault-password-file /home/dev/vault.txt
Defensive patterns

Strategy: validation

Validate before calling

import os

def readable_regular_file(path: str) -> bool:
    p = os.path.expanduser(path)
    return os.path.isfile(p) and os.access(p, os.R_OK)

if not readable_regular_file('vault.txt'):
    raise PermissionError(f'{path} missing/unreadable for uid={os.getuid()}')

Try / catch

from ansible.errors import AnsibleError

try:\n    pwd = CLI.get_password_from_file(f)\nexcept AnsibleError as e:\n    if isinstance(e.__cause__, PermissionError):\n        raise RuntimeError(f'{f} not readable by this user; fix ownership/mode') from e\n    raise

Prevention

When it happens

Trigger: Password file with mode 600 owned by another user (run under a different account/sudo context); file on an NFS/FUSE mount with permission oddities; file deleted between check and read in concurrent automation; path is a directory.

Common situations: Running ansible via sudo or a CI service account while the vault file is owned by the invoking user with 600; files copied between hosts without chown; container mounts with numeric UID mismatch; multi-job workspaces where cleanup removes the file mid-run.

Related errors

AI-assisted analysis of ansible/ansible@9cf16a4aca (2026-08-15). Data as JSON: /api/errors/22fd7ed324b28c14. Report an issue: GitHub.