# Ansible playbook execution | root restriction

**URL:** <https://forum.ansible.com/t/ansible-playbook-execution-root-restriction/30094>\
**Category:** Ansible Project\
**Created:** [April 11, 2019, 4:44am UTC](https://forum.ansible.com/t/ansible-playbook-execution-root-restriction/30094 "2019-04-11T04:44:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![subin\_alex](https://avatars.discourse-cdn.com/v4/letter/s/3e96dc/32.png) [@subin\_alex](https://forum.ansible.com/u/subin_alex)\
**Post date:** [April 11, 2019, 4:44am UTC](https://forum.ansible.com/t/ansible-playbook-execution-root-restriction/30094/1 "2019-04-11T04:44:07Z")

</div>

Hi All,

We are facing customer restriction on providing root access to run the ansible playbook .Our playbook needs root access to execute smooth.They are apprehensive about the commands executed by playbook thinking if it compromise their system security.

Our playbook is huge and it’s not possible for us to fetch them each os level command it execute.Is there any way to run the playbook using dzdo which can handle this restriction from customer.

Have any of you faced these situation and what are best possible solutions to such deadlock?

Please share your thoughts

Thanks,  
Subin

---

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [April 11, 2019, 5:00am UTC](https://forum.ansible.com/t/ansible-playbook-execution-root-restriction/30094/2 "2019-04-11T05:00:31Z")

</div>

Your client sounds reasonable.

Using root to run ansible isn’t recommended and common practice is to use a non root account in combination with privilege escalation, which defaults to sudo.  
Your case needs a different method:

—become-method=dzdo

[https://docs.ansible.com/ansible/latest/user\_guide/become.html](https://docs.ansible.com/ansible/latest/user_guide/become.html)

Dick

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [April 18, 2019, 4:29pm UTC](https://forum.ansible.com/t/ansible-playbook-execution-root-restriction/30094/3 "2019-04-18T16:29:07Z")

</div>

Don't assume Ansible just runs 'system commands', in many cases the  
modules use an API so 'list of system commands' is not something that  
will work.

The modules themselves are executed under sudo/user from a temporary  
dir in their home, so you can 'match' more or less what that 'command'  
will look like but it requires a lot of globbing to allow.

The modules Ansible ships with are open source, so they CAN be  
audited, as well as the shared code that operates on the systems.