Is that really true of most modules? AFAIK things like apt-get are not
available via a system call.
In the case of apt, it uses the python apt library which talks
directly to the apt bindings, it does shell out for some commands but
not all.
But take 'file' for example, it sets file permissions using the python
builtins which will not call 'chmod' command line.
Security is a big concern and it seems that Ansible is designed to require
SUDO anything, which kind of defeats the purpose of SUDO in the first place.
No, sudo is still there to control who can execute as which user,
ansible also supports SU. What you do loose is fine grained
permissions, which is one reason people use SUDO over SU.
And trying to get Ansible to work with password-less SUDO?
That is up to you, Ansible can use it with or without passwords as
different environments have different requirements and setups.
Allowing root access to any command with no password, somehow feels like we
have increased the size of the attack surface somewhat.
again, not a requirement, that is up to your setup.
If its impossible to support SUDO properly, why not make the Ansible SUDO
something predictable so that it can be explicitly permissioned? At least in
that scenario, Ansible is taking some responsibility.
Hard to do when you don't install anything on the machine, this is a
tradeoff for not having an agent, you could install ansible-pull on
the machines and use it to execute everything running as root from
cron (this is how most agent manage machines, by being root in the
first place).
Ansible can be mostly predicted by using the remote_tmp to control
where the scripts are put, there are issues like when sudoing to a non
root user in which this is switched to /tmp to allow both users access
(root does not normally have this problem unless NFS or something like
that is involved).
With pipelining we don't even copy the scripts to a location but
execute directly over ssh as a pipe, this prevents secrets from ever
being written to disk, but makes sudoers settings that much harder.
Are you using unpredictable temp-script names in the hope that this is more
secure, or to prevent multiple-executions from colliding?
mostly to avoid collisions, but it does help a bit to make it harder
for others to predict the script locations and drop in their own.