puppetlabs/puppet · critical · Puppet::Error

The yum provider can only be used as root

Error message

The yum provider can only be used as root

What it means

The yum provider hard-fails prefetch whenever the effective user is not root (Process.euid != 0), because its check-update-driven prefetch and installs cannot work unprivileged. The check at lib/puppet/provider/package/yum.rb:73 aborts the entire run before any package work, regardless of how many catalog resources use yum.

Source

Thrown at lib/puppet/provider/package/yum.rb:73

        end
      rescue RPM_VERSION_RANGE::ValidationFailure, RPM_VERSION::ValidationFailure
        Puppet.debug("Cannot parse #{should} as a RPM version range")
        return super
      end

      is.split(self.class::MULTIVERSION_SEPARATOR).any? do |version|
        is_version = RPM_VERSION.parse(version)
        should_version.include?(is_version)
      rescue RPM_VERSION::ValidationFailure
        Puppet.debug("Cannot parse #{is} as a RPM version")
      end
    end
  end

  VERSION_REGEX = /^(?:(\d+):)?(\S+)-(\S+)$/

  def self.prefetch(packages)
    raise Puppet::Error, _("The yum provider can only be used as root") if Process.euid != 0

    super
  end

  # Retrieve the latest package version information for a given package name
  # and combination of repos to enable and disable.
  #
  # @note If multiple package versions are defined (such as in the case where a
  #   package is built for multiple architectures), the first package found
  #   will be used.
  #
  # @api private
  # @param package [String] The name of the package to query
  # @param disablerepo [Array<String>] A list of repositories to disable for this query
  # @param enablerepo [Array<String>] A list of repositories to enable for this query
  # @param disableexcludes [Array<String>] A list of repository excludes to disable for this query
  # @return [Hash<Symbol, String>]
  def self.latest_package_version(package, disablerepo, enablerepo, disableexcludes)

View on GitHub (pinned to e227c27540)

Solutions

1. Run puppet as root: 'sudo puppet agent -t', or a root-owned systemd unit/cron entry
2. In containers/CI, run the job rootful when package management is in the catalog
3. If a non-root run is intentional, strip package resources that resolve to the yum provider from that node's role

Example fix

# before
puppet agent -t        # as deploy user -> yum provider aborts prefetch
# after
sudo puppet agent -t

# Ruby: gate yum-provider package work on root before it reaches prefetch
def root?
  Process.euid.zero?
end

def yum_usable?
  Process.euid.zero? && Puppet::Util::Execution.execute(['yum', '--version'], failonfail: false).exitstatus.zero?
end

begin
  Puppet::Type.type(:package).provider(:yum).prefetch(catalog_packages)
rescue Puppet::Error => e
  raise unless e.message == 'The yum provider can only be used as root'
  abort 'Re-run puppet as root to manage packages via yum'
end

When it happens

Trigger: Running 'puppet agent', 'puppet apply', or 'puppet resource package ...' as a non-root user on an el4-7/Amazon system where the yum provider is selected (defaultfor those releases) - prefetch raises immediately.

Common situations: Running puppet apply in CI or containers as a non-root user; admins debugging without sudo; scheduled jobs that drop privileges before invoking the agent.

Related errors

• Could not find package %{wanted}
• Could not find package %{name}
• Failed to update to version %{should}, got version %{version
• Could not back up %{file}: %{detail}
• %{path} is not readable

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/440b8d2781c3d355. Report an issue: GitHub.