{"record":{"id":"440b8d2781c3d355","repo":"puppetlabs/puppet","slug":"the-yum-provider-can-only-be-used-as-root","errorCode":null,"errorMessage":"The yum provider can only be used as root","messagePattern":"The yum provider can only be used as root","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"critical","filePath":"lib/puppet/provider/package/yum.rb","lineNumber":73,"sourceCode":"        end\n      rescue RPM_VERSION_RANGE::ValidationFailure, RPM_VERSION::ValidationFailure\n        Puppet.debug(\"Cannot parse #{should} as a RPM version range\")\n        return super\n      end\n\n      is.split(self.class::MULTIVERSION_SEPARATOR).any? do |version|\n        is_version = RPM_VERSION.parse(version)\n        should_version.include?(is_version)\n      rescue RPM_VERSION::ValidationFailure\n        Puppet.debug(\"Cannot parse #{is} as a RPM version\")\n      end\n    end\n  end\n\n  VERSION_REGEX = /^(?:(\\d+):)?(\\S+)-(\\S+)$/\n\n  def self.prefetch(packages)\n    raise Puppet::Error, _(\"The yum provider can only be used as root\") if Process.euid != 0\n\n    super\n  end\n\n  # Retrieve the latest package version information for a given package name\n  # and combination of repos to enable and disable.\n  #\n  # @note If multiple package versions are defined (such as in the case where a\n  #   package is built for multiple architectures), the first package found\n  #   will be used.\n  #\n  # @api private\n  # @param package [String] The name of the package to query\n  # @param disablerepo [Array<String>] A list of repositories to disable for this query\n  # @param enablerepo [Array<String>] A list of repositories to enable for this query\n  # @param disableexcludes [Array<String>] A list of repository excludes to disable for this query\n  # @return [Hash<Symbol, String>]\n  def self.latest_package_version(package, disablerepo, enablerepo, disableexcludes)","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/provider/package/yum.rb#L55-L91","documentation":"The yum provider hard-fails prefetch whenever the effective user is not root (Process.euid != 0), because its check-update-driven prefetch and installs cannot work unprivileged. The check at lib/puppet/provider/package/yum.rb:73 aborts the entire run before any package work, regardless of how many catalog resources use yum.","triggerScenarios":"Running 'puppet agent', 'puppet apply', or 'puppet resource package ...' as a non-root user on an el4-7/Amazon system where the yum provider is selected (defaultfor those releases) - prefetch raises immediately.","commonSituations":"Running puppet apply in CI or containers as a non-root user; admins debugging without sudo; scheduled jobs that drop privileges before invoking the agent.","solutions":["Run puppet as root: 'sudo puppet agent -t', or a root-owned systemd unit/cron entry","In containers/CI, run the job rootful when package management is in the catalog","If a non-root run is intentional, strip package resources that resolve to the yum provider from that node's role"],"exampleFix":"# before\npuppet agent -t        # as deploy user -> yum provider aborts prefetch\n# after\nsudo puppet agent -t","handlingStrategy":"validation","validationCode":"# Ruby: gate yum-provider package work on root before it reaches prefetch\ndef root?\n  Process.euid.zero?\nend","typeGuard":"def yum_usable?\n  Process.euid.zero? && Puppet::Util::Execution.execute(['yum', '--version'], failonfail: false).exitstatus.zero?\nend","tryCatchPattern":"begin\n  Puppet::Type.type(:package).provider(:yum).prefetch(catalog_packages)\nrescue Puppet::Error => e\n  raise unless e.message == 'The yum provider can only be used as root'\n  abort 'Re-run puppet as root to manage packages via yum'\nend","preventionTips":["Run puppet agents as root via systemd units or root cron","Mark non-root 'puppet resource' invocations as read-only (avoid package types)","Run CI containers rootful whenever the catalog manages packages"],"tags":["yum","permissions","root","prefetch","rhel"],"backgroundTag":"requires-root","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}