{"record":{"id":"605741851f63c550","repo":"puppetlabs/puppet","slug":"the-aix-provider-can-only-be-used-by-root","errorCode":null,"errorMessage":"The aix provider can only be used by root","messagePattern":"The aix provider can only be used by root","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/provider/package/aix.rb","lineNumber":48,"sourceCode":"  defaultfor 'os.name' => :aix\n\n  attr_accessor :latest_info\n\n  STATE_CODE = {\n    'A' => :applied,\n    'B' => :broken,\n    'C' => :committed,\n    'E' => :efix_locked,\n    'O' => :obsolete,\n    '?' => :inconsistent,\n  }.freeze\n\n  def self.srclistcmd(source)\n    [command(:installp), \"-L\", \"-d\", source]\n  end\n\n  def self.prefetch(packages)\n    raise Puppet::Error, _(\"The aix provider can only be used by root\") if Process.euid != 0\n\n    return unless packages.detect { |_name, package| package.should(:ensure) == :latest }\n\n    sources = packages.collect { |_name, package| package[:source] }.uniq.compact\n\n    updates = {}\n    sources.each do |source|\n      execute(srclistcmd(source)).each_line do |line|\n        next unless line =~ /^[^#][^:]*:([^:]*):([^:]*)/\n\n        current = {}\n        current[:name]    = Regexp.last_match(1)\n        current[:version] = Regexp.last_match(2)\n        current[:source]  = source\n\n        if updates.key?(current[:name])\n          previous = updates[current[:name]]\n","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/provider/package/aix.rb#L30-L66","documentation":"The AIX package provider (aix.rb:48) hard-fails its prefetch hook with Puppet::Error whenever the puppet process is not running as root (Process.euid != 0). Prefetch runs once per catalog compilation/agent run for every package resource assigned to this provider, so a single AIX package resource in the catalog makes any non-root run abort. It exists because installp/lslpp package operations on AIX are root-only.","triggerScenarios":"Running `puppet agent -t`, `puppet apply`, or `puppet resource package` as a non-root user on an AIX node whose catalog contains at least one package resource handled by the aix provider (its should(:ensure) triggers prefetch).","commonSituations":"Running puppet via sudo-less cron or a non-privileged CI account; using `puppet resource package` for inspection as a normal user; agent downgraded permissions after an RBAC change on AIX.","solutions":["Run puppet as root (sudo puppet agent -t) — this provider simply requires euid 0.","If you only wanted to inspect packages as non-root, use `rpm -qa` / `installp -L` directly instead of the puppet provider.","If rootless puppet is a hard requirement, remove/replace the package resources using the aix provider (e.g. manage via rpm provider) so prefetch is not invoked."],"exampleFix":"# before (as normal user): fails during prefetch\npuppet resource package ensure=latest provider=aix\n\n# after: elevate so Process.euid == 0\nsudo puppet resource package ensure=latest provider=aix","handlingStrategy":"validation","validationCode":"# only manage AIX packages when running as root\nfail 'aix provider requires root (Process.euid == 0)' unless Process.euid == 0\n# or in a wrapper: exec sudo puppet agent -t unless Process.uid == 0","typeGuard":null,"tryCatchPattern":"begin\n  packages.each { |p| p.provider.prefetch(nil) }\nrescue Puppet::Error => e\n  raise unless e.message == 'The aix provider can only be used by root'\n  Puppet.notice 'skipping AIX package work: run agent as root'\nend","preventionTips":["Run the puppet agent under root (or a properly privileged service account with euid 0) on AIX.","Gate AIX package profiles so inspection-only, non-root `puppet resource` sessions never touch them.","Document that prefetch of this provider is unconditional — one package resource is enough to require root."],"tags":["puppet","aix","packages","permissions"],"backgroundTag":"operation-requires-root","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}