become_user with sudo adds a -u flag

Archives Ansible Project
1

I am getting an error trying to run my ansible playbook and I have tracked it down to the ‘-u’ flag being added by Ansible when it attempts to sudo.

Here is the error I get:

fatal: [server]: FAILED! => {“changed”: false, “failed”: true, “module_stderr”: “sudo: unknown user: su_root\nsudo: unable to initialize policy plugin\n”, “module_stdout”: “”, “msg”: “MODULE FAILURE”}

I was getting an additional message that mentioned 3 ways to fix this. Once I added the pipeline option to my ansible.cfg file I stopped getting that message and now only get the message you see above.

Here is my relevant task:

When I ran my script with -vvvv flag I noticed ansible was doing this for sudo:

sudo -H -S -n -u su_root /bin/sh -c

I don’t have a root account named ‘root’ on this box I am SSHing to. Instead the root account is actually ‘su_root’. This is not my choice but I have to live with it.

All the SSH and SUDO stuff is done password-less via certs.

So without ansible I can SSH as ‘sshusr’ to my box and I can type: ‘sudo su_root’ and get switched to the root account without a problem. I experimented removing flags until the command worked and it turned out the offending flag is the ‘-u’ flag. So running:

sudo -H -S -n su_root /bin/sh -c

works.

I have tried specifying flags in my task with ‘become_flags’ and in the ansible.cfg [defaults] ‘sudo_flags’ in hopes of overriding those flags but regardless of what I have in either location ansible goes ahead and puts in the ‘-u’ flag.

Am I doing something wrong? I can remove any of the other flags but not the -u flag.

JB

2

I’ve tried a number of combinations with the ansible.cfg and my playbook to no avail. If this was an open source project I could find out how the -u flag is being used. As it is I am at the mercy of this forum.

3

I suspect su_root is not a user but an alias or program that then runs
`su - root`, ansible will add -u <user> if you set a user every time,
the only way to avoid it by not setting a user.

4

Turns out on my linux machine su_root is not a user but a script for doing ‘su - root’. Given it’s a script and not an actual user I can just use the command module like so: command: sudo su_root. Or put that in a with_items block underneath a command I am running.

5

Just saw you’re reply. You are correct. It was a program that does the su - root for me. Cue the Fail Horns.