Ansible can pick an executable but you can not arbitrary confine sudo since it runs lots of ansible modules not simple shell commands.
I believe the docs already discuss it to the proper depth. On Tue, Jun 17, 2014 at 6:59 PM, Cameron Junge <[email protected]> wrote: > Yes that's correct, or at least that was the intention. > > I was hoping to be able to restrict sudo to just be able to run eg. sudo > service nginx restart, but by using /bin/sh to wrap the call it breaks that > intention. > > So I take it that there is no way to use ansible to call a command via > sudo without ansible using /bin/sh? (ignoring that I could use shell: sudo > service nginx restart). > > if there is no way of doing this, maybe the docs should be updated to > reflect this? > > Cheers, Cameron > > > > > On Monday, 16 June 2014 13:28:25 UTC+12, Michael DeHaan wrote: > >> Do I infer correctly that you have your sudo environment locked down so >> users can only run specific commands? If so, that won't be compatible. >> >> >> >> >> On Sun, Jun 15, 2014 at 7:15 PM, Cameron Junge <[email protected]> wrote: >> >>> Hi All, >>> >>> Just getting started with Ansible and I'm having issues with some of the >>> sudo stuff. >>> >>> I have a user deployer, who has limited permissions on the server. >>> Neither deployer nor root have a password set, I'm using ssh keys for >>> deployer. >>> >>> I am trying to give deployer permission to stop/start services on the >>> server, and have tried to give them access in sudoers: >>> >>> deployer ALL=(root) NOPASSWD: /usr/sbin/service >>> >>> In my playbook I have a task: >>> >>> tasks: >>> - name: Stop Nginx >>> sudo: yes >>> service: >>> name: nginx >>> state: stopped >>> >>> From what I can see, the "sudo: yes" causes the script to be wrapped in >>> an Ansible sudo call, which uses /bin/sh to run the generated script. As >>> the user doesn't have permission to run /bin/sh as root the result is the >>> play locking up waiting for a password to be entered. >>> >>> <server> ESTABLISH CONNECTION FOR USER: deployer >>> <server> REMOTE_MODULE service name=nginx state=stopped >>> <server> EXEC ['ssh', '-C', '-tt', '-vvv', '-o', 'ControlMaster=auto', >>> '-o', 'ControlPersist=60s', '-o', 'ControlPath=/home/cameron/. >>> ansible/cp/ansible-ssh-%h-%p-%r', '-o', 'Port=22', '-o', >>> 'KbdInteractiveAuthentication=no', '-o', 'PreferredAuthentications= >>> gssapi-with-mic,gssapi-keyex,hostbased,publickey', '-o', >>> 'PasswordAuthentication=no', '-o', 'User=deployer', '-o', >>> 'ConnectTimeout=10', 'server', "/bin/sh -c 'mkdir -p >>> $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072 && chmod >>> a+rx $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072 && >>> echo $HOME/.ansible/tmp/ansible-tmp-1402872399.78-47692345481072'"] >>> <server> PUT /tmp/tmpzh6oFh TO /home/deployer/.ansible/tmp/ >>> ansible-tmp-1402872399.78-47692345481072/service >>> <server> EXEC ['ssh', '-C', '-tt', '-vvv', '-o', 'ControlMaster=auto', >>> '-o', 'ControlPersist=60s', '-o', 'ControlPath=/home/cameron/. >>> ansible/cp/ansible-ssh-%h-%p-%r', '-o', 'Port=22', '-o', >>> 'KbdInteractiveAuthentication=no', '-o', 'PreferredAuthentications= >>> gssapi-with-mic,gssapi-keyex,hostbased,publickey', '-o', >>> 'PasswordAuthentication=no', '-o', 'User=deployer', '-o', >>> 'ConnectTimeout=10', 'server', u'/bin/sh -c \'sudo -k && sudo -H -S -p >>> "[sudo via ansible, key=xqpamkcjagkzzsxuwdwnijqkrpitvqyy] password: " >>> -u root /bin/sh -c \'"\'"\'echo SUDO-SUCCESS- >>> xqpamkcjagkzzsxuwdwnijqkrpitvqyy; LC_CTYPE=C LANG=C /usr/bin/python >>> /home/deployer/.ansible/tmp/ansible-tmp-1402872399.78- >>> 47692345481072/service\'"\'"\'\''] >>> >>> I could set the user to have permission to run /bin/sh, but that seems >>> incorrect (may as well set it to ALL, which btw does work as I desire). >>> >>> Is this something that I can resolve either in sudoers, or in the >>> Ansible script? >>> >>> Any help would be appreciated. >>> >>> Cheers, Cameron >>> >>> -- >>> You received this message because you are subscribed to the Google >>> Groups "Ansible Project" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to [email protected]. >>> To post to this group, send email to [email protected]. >>> >>> To view this discussion on the web visit https://groups.google.com/d/ >>> msgid/ansible-project/9d3e18d5-7c56-49d3-9339- >>> f605f87655f8%40googlegroups.com >>> <https://groups.google.com/d/msgid/ansible-project/9d3e18d5-7c56-49d3-9339-f605f87655f8%40googlegroups.com?utm_medium=email&utm_source=footer> >>> . >>> For more options, visit https://groups.google.com/d/optout. >>> >> >> -- > You received this message because you are subscribed to the Google Groups > "Ansible Project" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To post to this group, send email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/ansible-project/3085ef84-2877-495f-bca6-c7eba13010ab%40googlegroups.com > <https://groups.google.com/d/msgid/ansible-project/3085ef84-2877-495f-bca6-c7eba13010ab%40googlegroups.com?utm_medium=email&utm_source=footer> > . > > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "Ansible Project" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/CA%2BnsWgx_wCnswrCtvXCs56%3D2e1oSUvvh5tkjXf71uQnJghUUdg%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
