Failed to read NuGet.Config due to unauthorized access

[patelriki13]

Azure Devops Taks:

- task: NuGetCommand@2
	displayName: "Nuget push"
	condition: ne(variables['Build.Reason'], 'PullRequest')
	inputs:
	  command: 'push'
	  packagesToPush: '$(Build.ArtifactStagingDirectory)/**/*.nupkg;!$(Build.ArtifactStagingDirectory)/**/*.symbols.nupkg'
	  nuGetFeedType: 'internal'
	  publishVstsFeed: '430cf929-c089-47f8-8cb4-8709a8b0d712/9efe7be0-9127-42ef-b117-5074f23e8f28'
	  nugetConfigPath: 'nuget.config'

Error:

Starting: Nuget push
==============================================================================
Task         : NuGet
Description  : Restore, pack, or push NuGet packages, or run a NuGet command. Supports NuGet.org and authenticated feeds like Azure Artifacts and MyGet. Uses NuGet.exe and works with .NET Framework apps. For .NET Core and .NET Standard apps, use the .NET Core task.
Version      : 2.222.0
Author       : Microsoft Corporation
Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/package/nuget
==============================================================================
Detected NuGet version 6.7.0.127 / 6.7.0+b46f5f64159a81d930ac8cdfde96e76f90796c62.b46f5f64159a81d930ac8cdfde96e76f90796c62
/usr/bin/mono /opt/hostedtoolcache/NuGet/6.7.0/x64/nuget.exe push /agent/_work/1/a/xxx.nupkg -NonInteractive -Source https://pkgs.dev.azure.com/xx/nuget/v3/index.json
Failed to read NuGet.Config due to unauthorized access. Path: '/home/floodlead-admin/.config/NuGet/NuGet.Config'.
  Access to the path '/home/floodlead-admin/.config/NuGet' is denied.
  Permission denied
NuGet.Configuration.NuGetConfigurationException: Failed to read NuGet.Config due to unauthorized access. Path: '/home/floodlead-admin/.config/NuGet/NuGet.Config'. ---> System.UnauthorizedAccessException: Access to the path '/home/floodlead-admin/.config/NuGet' is denied. ---> System.IO.IOException: Permission denied
   --- End of inner exception stack trace ---
  at System.IO.FileSystem.CreateDirectory (System.String fullPath) [0x00191] in <d636f104d58046fd9b195699bcb1a744>:0 
  at System.IO.Directory.CreateDirectory (System.String path) [0x0002c] in <d636f104d58046fd9b195699bcb1a744>:0 
  at NuGet.Configuration.FileSystemUtility.AddFile (System.String fullPath, System.Action`1[T] writeToStream) [0x00006] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
  at NuGet.Configuration.FileSystemUtility.GetOrCreateDocument (System.Xml.Linq.XDocument content, System.String fullPath) [0x0001e] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
  at NuGet.Configuration.SettingsFile+<>c__DisplayClass23_0.<.ctor>b__0 () [0x00017] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
  at NuGet.Configuration.SettingsFile+<>c__DisplayClass32_0.<ExecuteSynchronized>b__0 () [0x00000] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
   --- End of inner exception stack trace ---
  at NuGet.Configuration.SettingsFile+<>c__DisplayClass32_0.<ExecuteSynchronized>b__0 () [0x0005f] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
  at NuGet.Common.ConcurrencyUtilities.ExecuteWithFileLocked (System.String filePath, System.Action action) [0x00098] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
  at NuGet.Configuration.SettingsFile.ExecuteSynchronized (System.Action ioOperation) [0x0001a] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
  at NuGet.Configuration.SettingsFile..ctor (System.String directoryPath, System.String fileName, System.Boolean isMachineWide, System.Boolean isReadOnly) [0x000ab] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
  at NuGet.Configuration.Settings.ReadSettings (System.String settingsRoot, System.String settingsPath, System.Boolean isMachineWideSettings, System.Boolean isAdditionalUserWideConfig, NuGet.Configuration.SettingsLoadingContext settingsLoadingContext) [0x0002a] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
  at NuGet.Configuration.Settings+<LoadUserSpecificSettings>d__32.MoveNext () [0x0007e] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
  at System.Collections.Generic.List`1[T].AddEnumerable (System.Collections.Generic.IEnumerable`1[T] enumerable) [0x00059] in <d636f104d58046fd9b195699bcb1a744>:0 
  at System.Collections.Generic.List`1[T].InsertRange (System.Int32 index, System.Collections.Generic.IEnumerable`1[T] collection) [0x000f4] in <d636f104d58046fd9b195699bcb1a744>:0 
  at System.Collections.Generic.List`1[T].AddRange (System.Collections.Generic.IEnumerable`1[T] collection) [0x00000] in <d636f104d58046fd9b195699bcb1a744>:0 
  at NuGet.Configuration.Settings.LoadSettingsForSpecificConfigs (System.String root, System.String configFileName, System.Collections.Generic.List`1[T] validSettingFiles, NuGet.Configuration.IMachineWideSettings machineWideSettings, System.Boolean loadUserWideSettings, System.Boolean useTestingGlobalPath, NuGet.Configuration.SettingsLoadingContext settingsLoadingContext) [0x00025] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
  at NuGet.Configuration.Settings.LoadSettings (System.String root, System.String configFileName, NuGet.Configuration.IMachineWideSettings machineWideSettings, System.Boolean loadUserWideSettings, System.Boolean useTestingGlobalPath, NuGet.Configuration.SettingsLoadingContext settingsLoadingContext) [0x0007a] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
  at NuGet.Configuration.Settings.LoadDefaultSettings (System.String root, System.String configFileName, NuGet.Configuration.IMachineWideSettings machineWideSettings, NuGet.Configuration.SettingsLoadingContext settingsLoadingContext) [0x00000] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
  at NuGet.Configuration.Settings.LoadDefaultSettings (System.String root, System.String configFileName, NuGet.Configuration.IMachineWideSettings machineWideSettings) [0x00000] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
  at NuGet.CommandLine.Command.Execute () [0x00066] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
  at NuGet.CommandLine.Program.MainCore (System.String workingDirectory, System.String[] args) [0x001c7] in <6484ae034e4e4be89d06d0b5f786e57c>:0 
##[error]The nuget command failed with exit code(1) and error(Failed to read NuGet.Config due to unauthorized access. Path: '/home/floodlead-admin/.config/NuGet/NuGet.Config'.

Same issue for git also...

##[error]ERROR: /home/floodlead-admin/.config/jgit/config
java.nio.file.AccessDeniedException: /home/floodlead-admin/.config/jgit/config
	at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:90)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:116)
	at java.base/sun.nio.fs.UnixFileAttributeViews$Basic.readAttributes(UnixFileAttributeViews.java:55)
	at java.base/sun.nio.fs.UnixFileSystemProvider.readAttributes(UnixFileSystemProvider.java:149)
	at java.base/sun.nio.fs.LinuxFileSystemProvider.readAttributes(LinuxFileSystemProvider.java:99)
	at java.base/java.nio.file.Files.readAttributes(Files.java:1764)
	at org.eclipse.jgit.util.FileUtils.fileAttributes(FileUtils.java:804)
	at org.eclipse.jgit.util.FS.fileAttributes(FS.java:1273)
	at org.eclipse.jgit.internal.storage.file.FileSnapshot.isModified(FileSnapshot.java:320)
	at org.eclipse.jgit.storage.file.FileBasedConfig.isOutdated(FileBasedConfig.java:225)
	at org.eclipse.jgit.util.SystemReader.updateAll(SystemReader.java:396)
	at org.eclipse.jgit.util.SystemReader.getJGitConfig(SystemReader.java:349)
	at org.eclipse.jgit.util.SystemReader.getSystemConfig(SystemReader.java:371)
	at org.eclipse.jgit.util.SystemReader.getUserConfig(SystemReader.java:319)
	at org.eclipse.jgit.internal.storage.file.FileRepository.<init>(FileRepository.java:161)
	at org.eclipse.jgit.lib.BaseRepositoryBuilder.build(BaseRepositoryBuilder.java:625)
	at org.sonar.scm.git.JGitUtils.buildRepository(JGitUtils.java:34)
	at org.sonar.scm.git.IncludedFilesRepository.indexFiles(IncludedFilesRepository.java:50)
	at org.sonar.scm.git.IncludedFilesRepository.<init>(IncludedFilesRepository.java:41)
	at org.sonar.scm.git.GitIgnoreCommand.init(GitIgnoreCommand.java:37)
	at org.sonar.scanner.scan.filesystem.ProjectFileIndexer.index(ProjectFileIndexer.java:114)
	at org.sonar.scanner.scan.SpringProjectScanContainer.doAfterStart(SpringProjectScanContainer.java:363)
	at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:188)
	at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:167)
	at org.sonar.scanner.bootstrap.SpringGlobalContainer.doAfterStart(SpringGlobalContainer.java:137)
	at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:188)
	at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:167)
	at org.sonar.batch.bootstrapper.Batch.doExecute(Batch.java:72)
	at org.sonar.batch.bootstrapper.Batch.execute(Batch.java:66)
	at org.sonarsource.scanner.api.internal.batch.BatchIsolatedLauncher.execute(BatchIsolatedLauncher.java:46)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at org.sonarsource.scanner.api.internal.IsolatedLauncherProxy.invoke(IsolatedLauncherProxy.java:60)
	at com.sun.proxy.$Proxy0.execute(Unknown Source)
	at org.sonarsource.scanner.api.EmbeddedScanner.doExecute(EmbeddedScanner.java:189)
	at org.sonarsource.scanner.api.EmbeddedScanner.execute(EmbeddedScanner.java:138)
	at org.sonarsource.scanner.cli.Main.execute(Main.java:126)
	at org.sonarsource.scanner.cli.Main.execute(Main.java:81)
	at org.sonarsource.scanner.cli.Main.main(Main.java:62)

Pipeline run on linux using AzDevOps user.
so why all tool try to point floodlead-admin user folder?
how to fix this issue?

[vpolikarpov-akvelon]

Hey @patelriki13. You are using self-hosted runners, aren't you? If so, it somehow relates with initial runner configuration or a way runner itself is installed or configured. We could help probably if you share more information about runner you are using.

[patelriki13]

Thanks for reply.

FYI, Yes its self hosted linux agent.

[patelriki13]

The issue was probably the execution order I'd set on the custom script extension. When DevOps updates the pipeline extension, it wants to set the custom script to execute before the pipeline extension.

So, Please check or change your execution order of the extension to fix the issue.