# Allowed specific commands with NOPASSWD in sudoers file, Ansible complains... **URL:** \ **Category:** Ansible Project\ **Tags:** ansible-project\ **Created:** [November 9, 2015, 11:00pm UTC](https://forum.ansible.com/t/allowed-specific-commands-with-nopasswd-in-sudoers-file-ansible-complains/19716 "2015-11-09T23:00:48Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [November 9, 2015, 11:00pm UTC](https://forum.ansible.com/t/allowed-specific-commands-with-nopasswd-in-sudoers-file-ansible-complains/19716/1 "2015-11-09T23:00:48Z")
no, the issue is that ansible does not support fine grained sudo permissions, it executes a python file which might execute the commands you see, but the sudo wraps the entire thing, not just the command. ---
**Author:** ![Jeff1](https://avatars.discourse-cdn.com/v4/letter/j/4af34b/32.png) [@Jeff1](https://forum.ansible.com/u/Jeff1)\ **Post date:** [November 10, 2015, 12:20pm UTC](https://forum.ansible.com/t/allowed-specific-commands-with-nopasswd-in-sudoers-file-ansible-complains/19716/2 "2015-11-10T12:20:40Z")
So that’s a security bug then. The point of sudo is to enable fine-grained control rather than just granting root access to everything. Ansible needs to be upgraded to only SUDO the expected commands rather than an entire script that does other things that are not visible. This is the same as [https://github.com/ansible/ansible/issues/13077](https://github.com/ansible/ansible/issues/13077) So I guess you get this question a lot. ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [November 10, 2015, 5:28pm UTC](https://forum.ansible.com/t/allowed-specific-commands-with-nopasswd-in-sudoers-file-ansible-complains/19716/3 "2015-11-10T17:28:34Z")
The purpose of sudo is to allow for privilege escalation, the fine grained escalation is a feature. The way ansible works currently requires arbitrary commands specs, this is not a bug, but it is a limitation. This won't work for all environments, specifically those that only allow specific commands. This is a feature we want to add, but it won't work with all modules, it would only work with modules that shell out to run commands. For example, if a module changes ownership of a file using the python/perl/ruby function to do so, it would not work with `/bin/chmod` permissions in sudoers as they will be making a system call and not running a command. ---
**Author:** ![Jonathan\_Bouzekri](https://avatars.discourse-cdn.com/v4/letter/j/a4c791/32.png) [@Jonathan\_Bouzekri](https://forum.ansible.com/u/Jonathan_Bouzekri)\ **Post date:** [January 26, 2017, 6:11pm UTC](https://forum.ansible.com/t/allowed-specific-commands-with-nopasswd-in-sudoers-file-ansible-complains/19716/4 "2017-01-26T18:11:16Z")
Hi Is there any progress on this feature? is it available in the latest version of ansible? More specifically on the service module (for example to allow reloading of specific services) Thanks ---
**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\ **Post date:** [January 27, 2017, 1:41pm UTC](https://forum.ansible.com/t/allowed-specific-commands-with-nopasswd-in-sudoers-file-ansible-complains/19716/5 "2017-01-27T13:41:27Z")
As you don't quote what you are talking about I can only assume the title is what you are after. No, ansible needs to run something like "sudo -H -S -n -u root /bin/bash" to work. You might set that to NOPASSWD, but it just means you allow the ansible user everything. Johannes ---
**Author:** ![Jonathan\_Bouzekri](https://avatars.discourse-cdn.com/v4/letter/j/a4c791/32.png) [@Jonathan\_Bouzekri](https://forum.ansible.com/u/Jonathan_Bouzekri)\ **Post date:** [January 27, 2017, 2:36pm UTC](https://forum.ansible.com/t/allowed-specific-commands-with-nopasswd-in-sudoers-file-ansible-complains/19716/6 "2017-01-27T14:36:52Z")
Sorry I started a discussion on this before seeing this one : [https://groups.google.com/d/msg/ansible-project/TZoUZUPO5no/6ZOxMmF3BQAJ](https://groups.google.com/d/msg/ansible-project/TZoUZUPO5no/6ZOxMmF3BQAJ) Yes I mean to restrict (with sudoes configuration or something else) on the OS side, the command the user can execute but still allow ansible to execute. We are using ansible for code deployment and there is a single task which needs become privilege : nginx reload. So except the NOPASSWD settings, is there any other solution ? If not it seems to me it is a big drawback on Ansible to be used as code shipping tools.