# become\_user with sudo adds a -u flag

**URL:** <https://forum.ansible.com/t/become-user-with-sudo-adds-a-u-flag/23984>\
**Category:** Ansible Project\
**Created:** [March 15, 2017, 7:45pm UTC](https://forum.ansible.com/t/become-user-with-sudo-adds-a-u-flag/23984 "2017-03-15T19:45:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Justin\_Bleach](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Justin\_Bleach](https://forum.ansible.com/u/Justin_Bleach)\
**Post date:** [March 15, 2017, 7:45pm UTC](https://forum.ansible.com/t/become-user-with-sudo-adds-a-u-flag/23984/1 "2017-03-15T19:45:13Z")

</div>

I am getting an error trying to run my ansible playbook and I have tracked it down to the ‘-u’ flag being added by Ansible when it attempts to sudo.

Here is the error I get:

fatal: [server]: FAILED! =\> {“changed”: false, “failed”: true, “module\_stderr”: “sudo: unknown user: su\_root\nsudo: unable to initialize policy plugin\n”, “module\_stdout”: “”, “msg”: “MODULE FAILURE”}

I was getting an additional message that mentioned 3 ways to fix this. Once I added the pipeline option to my ansible.cfg file I stopped getting that message and now only get the message you see above.

Here is my relevant task:

- name: Add Docker YUM Repo  
remote\_user: sshuser  
become: true  
become\_user: su\_root  
command: yum-config-manager --add-repo [https://download.docker.com/linux/centos/docker-ce.repo](https://download.docker.com/linux/centos/docker-ce.repo)

When I ran my script with -vvvv flag I noticed ansible was doing this for sudo:

sudo -H -S -n -u su\_root /bin/sh -c

I don’t have a root account named ‘root’ on this box I am SSHing to. Instead the root account is actually ‘su\_root’. This is not my choice but I have to live with it.

All the SSH and SUDO stuff is done password-less via certs.

So without ansible I can SSH as ‘sshusr’ to my box and I can type: ‘sudo su\_root’ and get switched to the root account without a problem. I experimented removing flags until the command worked and it turned out the offending flag is the ‘-u’ flag. So running:

sudo -H -S -n su\_root /bin/sh -c

works.

I have tried specifying flags in my task with ‘become\_flags’ and in the ansible.cfg [defaults] ‘sudo\_flags’ in hopes of overriding those flags but regardless of what I have in either location ansible goes ahead and puts in the ‘-u’ flag.

Am I doing something wrong? I can remove any of the other flags but not the -u flag.

JB

---

<div class="post-metadata">

**Author:** ![Justin\_Bleach](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Justin\_Bleach](https://forum.ansible.com/u/Justin_Bleach)\
**Post date:** [March 16, 2017, 12:27pm UTC](https://forum.ansible.com/t/become-user-with-sudo-adds-a-u-flag/23984/2 "2017-03-16T12:27:51Z")

</div>

I’ve tried a number of combinations with the ansible.cfg and my playbook to no avail. If this was an open source project I could find out how the -u flag is being used. As it is I am at the mercy of this forum.

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [March 16, 2017, 1:24pm UTC](https://forum.ansible.com/t/become-user-with-sudo-adds-a-u-flag/23984/3 "2017-03-16T13:24:24Z")

</div>

I suspect su\_root is not a user but an alias or program that then runs  
`su - root`, ansible will add -u \<user\> if you set a user every time,  
the only way to avoid it by not setting a user.

---

<div class="post-metadata">

**Author:** ![Justin\_Bleach](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Justin\_Bleach](https://forum.ansible.com/u/Justin_Bleach)\
**Post date:** [March 16, 2017, 2:54pm UTC](https://forum.ansible.com/t/become-user-with-sudo-adds-a-u-flag/23984/4 "2017-03-16T14:54:03Z")

</div>

Turns out on my linux machine su\_root is not a user but a script for doing ‘su - root’. Given it’s a script and not an actual user I can just use the command module like so: command: sudo su\_root. Or put that in a with\_items block underneath a command I am running.

---

<div class="post-metadata">

**Author:** ![Justin\_Bleach](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Justin\_Bleach](https://forum.ansible.com/u/Justin_Bleach)\
**Post date:** [March 16, 2017, 2:55pm UTC](https://forum.ansible.com/t/become-user-with-sudo-adds-a-u-flag/23984/5 "2017-03-16T14:55:05Z")

</div>

Just saw you’re reply. You are correct. It was a program that does the su - root for me. Cue the Fail Horns.