# Executable in shell module vs ansible.cfg

**URL:** <https://forum.ansible.com/t/executable-in-shell-module-vs-ansible-cfg/39625>\
**Category:** Get Help\
**Created:** [January 15, 2025, 3:24pm UTC](https://forum.ansible.com/t/executable-in-shell-module-vs-ansible-cfg/39625 "2025-01-15T15:24:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rwagnergit](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/rwagnergit/32/7219_2.png) [@rwagnergit](https://forum.ansible.com/u/rwagnergit)\
**Post date:** [January 15, 2025, 3:24pm UTC](https://forum.ansible.com/t/executable-in-shell-module-vs-ansible-cfg/39625/1 "2025-01-15T15:24:28Z")

</div>

Because of sudo restrictions in my environment, I need to use a different executable for a single task. If I include executable: in the shell module, it seems to be ignored. But if I set executable: in ansible.cfg, it is honored.

```auto
#> cat sudo.yml
---
- hosts: localhost
  gather_facts: no
  tasks:
  - name: test
    shell: /home/oracle/rowagn.sh
    changed_when: false
    args:
      executable: /etc/ansible-wrapper
    delegate_to: "vspoem04.vsp.sas.com"
    become: yes
    become_user: oracle

```

Running the above with -vvv show the problem. Here’s the relevant output:

```auto
<vspoem04.vsp.sas.com> SSH: EXEC ssh -C -o ControlMaster=no -o StrictHostKeyChecking=no -o ServerAliveInterval=60 -o ServerAliveCountMax=1000 -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=20 vspoem04.vsp.sas.com '/bin/sh -c '"'"'sudo -H -S -p "[sudo via ansible, key=qfuuuthiowaoyrfzswwxnoutxmrrbzdn] password:" -u oracle /bin/sh -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-qfuuuthiowaoyrfzswwxnoutxmrrbzdn ; /usr/bin/python'"'"'"'"'"'"'"'"' && sleep 0'"'"''

```

but if I add executable: /etc/ansible-wrapper to ansible.cfg and run it:

```auto
<vspoem04.vsp.sas.com> SSH: EXEC ssh -C -o ControlMaster=no -o StrictHostKeyChecking=no -o ServerAliveInterval=60 -o ServerAliveCountMax=1000 -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=20 vspoem04.vsp.sas.com '/etc/ansible-wrapper -c '"'"'sudo -H -S -p "[sudo via ansible, key=scxpgodaimxpktbshaidfkbmbppdalxd] password:" -u oracle /etc/ansible-wrapper -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-scxpgodaimxpktbshaidfkbmbppdalxd ; /usr/bin/python'"'"'"'"'"'"'"'"' && sleep 0'"'"''
Escalation succeeded

```

How can I get shell to honor executable?

Thanks  
Rob

---

<div class="post-metadata">

**Author:** ![rwagnergit](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/rwagnergit/32/7219_2.png) [@rwagnergit](https://forum.ansible.com/u/rwagnergit)\
**Post date:** [January 15, 2025, 3:26pm UTC](https://forum.ansible.com/t/executable-in-shell-module-vs-ansible-cfg/39625/2 "2025-01-15T15:26:25Z")

</div>

I tried to format my post but got an error about new users can only put two links.

The difference is in the command immediately after sudo -u oracle. In the non-working example, Ansible is using /vin/sh, but in the working example, it is using /etc/ansible-wrapper.

---

<div class="post-metadata">

**Author:** ![rwagnergit](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/rwagnergit/32/7219_2.png) [@rwagnergit](https://forum.ansible.com/u/rwagnergit)\
**Post date:** [January 15, 2025, 5:59pm UTC](https://forum.ansible.com/t/executable-in-shell-module-vs-ansible-cfg/39625/3 "2025-01-15T17:59:04Z")

</div>

Also tried adding

become\_flags: ‘-s /etc/ansible-wrapper’

and that fails with sudo: no tty present and no askpass program specified