why is mco blocked to run as root?

[lasnoles]

mco tasks run apt action=update -v

Retrieving task metadata for task apt from the Puppet Server

Invalid input:
expects a value for parameter 'action'

The tasks application failed to run: The Choria client cannot be run as root

The Choria client cannot be run as root (MCollective::Util::Choria::UserError)
from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/util/choria.rb:473:in check_ssl_setup' <---- from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/connector/nats.rb:101:in configure_tls'
from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/connector/nats.rb:84:in connect' from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/client.rb:38:in block in initialize'
from /opt/puppetlabs/puppet/lib/ruby/3.2.0/timeout.rb:189:in block in timeout' from /opt/puppetlabs/puppet/lib/ruby/3.2.0/timeout.rb:196:in timeout'
from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/client.rb:37:in initialize' from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/rpc/client.rb:47:in new'
from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/rpc/client.rb:47:in initialize' from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/rpc.rb:69:in new'
from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/rpc.rb:69:in rpcclient' from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/application.rb:387:in rpcclient'
from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/application/tasks.rb:392:in bolt_tasks' from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/application/tasks.rb:396:in reset_client!'
from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/application/tasks.rb:221:in ensure in run_command' from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/application/tasks.rb:221:in run_command'
from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/application/tasks.rb:434:in main' from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/application.rb:313:in run'
from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/application/tasks.rb:384:in run' from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/lib/mcollective/applications.rb:23:in run'
from /opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/choria-mcorpc-support-2.26.4/bin/mco:33:in <top (required)>' from /usr/bin/mco:25:in load'
from /usr/bin/mco:25:in `

'

[vjanelle]

Because you don't need to and it's not secure to do so.

Specifically there's no functionality in the client that requires root, and there's various aspects of things historically that would be dangerous if you did so, or the author's opinion (which I share). Go look into the history of "DONT_BLAME_SENDMAIL".

If you think you really absolutely need to do this (and I guarantee you don't), go look at the source code for the clients.