# How to use include\_vars with a file needing elevated privileges **URL:** \ **Category:** Ansible Project\ **Created:** [March 17, 2022, 4:19pm UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456 "2022-03-17T16:19:21Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![actionmystique](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/actionmystique/32/1678_2.png) [@actionmystique](https://forum.ansible.com/u/actionmystique)\ **Post date:** [March 17, 2022, 4:19pm UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456/1 "2022-03-17T16:19:21Z")
Let’s suppose I run a playbook as a non-root user and one task needs to include a vars file with only root permissions. The [ansible.builtin.include\_vars official doc](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/include_vars_module.html#attributes) states that:the ‘become’ attribute is not supported but “Is usable alongside become keywords”, which seems to contradict the fact that it is unsupported. I tried to use the become vars but that does not work either: - name: Including vars issue hosts: all gather\_facts: false tasks: - name: Creating a file with root-only permissions vars: ansible\_become: yes ansible\_become\_method: sudo ansible\_become\_user: root file: group: ‘root’ mode: ‘0640’ owner: ‘root’ path: “…/files/restricted\_file” state: touch - name: Including vars with root-only permissions vars: ansible\_become: yes ansible\_become\_method: sudo ansible\_become\_user: root include\_vars: “…/files/restricted\_file” ignore\_errors: true - name: Including vars with non-root user permissions vars: ansible\_become: yes ansible\_become\_method: sudo ansible\_become\_user: admin include\_vars: “…/files/capabilities.json” leads to: ---
**Author:** ![actionmystique](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/actionmystique/32/1678_2.png) [@actionmystique](https://forum.ansible.com/u/actionmystique)\ **Post date:** [March 17, 2022, 5:59pm UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456/2 "2022-03-17T17:59:58Z")
It seems to be a tricky one. I am using ansible core 2.12.3. Does @Brian Coca have any suggestion? ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [March 17, 2022, 6:59pm UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456/3 "2022-03-17T18:59:23Z")
The “become” bits have to do with privilege escalation for Ansible tasks that run on the target hosts. Including/importing vars and friends happen on the Ansible controller, not the target hosts. It doesn’t matter that your target host and your Ansible controller are the same host. Controller bits aren’t privilege escalated. ---
**Author:** ![actionmystique](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/actionmystique/32/1678_2.png) [@actionmystique](https://forum.ansible.com/u/actionmystique)\ **Post date:** [March 17, 2022, 7:02pm UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456/4 "2022-03-17T19:02:56Z")
Are you implying that it is not possible to include a vars file on the controller that require higher privileges than the user’s permissions running the playbook? ---
**Author:** ![actionmystique](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/actionmystique/32/1678_2.png) [@actionmystique](https://forum.ansible.com/u/actionmystique)\ **Post date:** [March 17, 2022, 7:04pm UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456/5 "2022-03-17T19:04:29Z")
Also, what does “Is usable alongside become keywords” mean? ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [March 17, 2022, 7:10pm UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456/6 "2022-03-17T19:10:29Z")
Yes, I implied exactly that. I should have stated it explicitly. (Also, I think it’s true, but Ansible has surprised me more than once before.) ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [March 17, 2022, 7:21pm UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456/7 "2022-03-17T19:21:30Z")
“Is usable alongside become keywords” is a description of the “becomes” attribute. The key point for your case is the red “none” in the “Support” column, which together means that no amount of “become” shenanigans is going to affect the behavior of include\_vars. Interpretation of the “Attributes” table is a bit obscure and error prone from users’ perspectives, IMHO. I believe it’s showing a peek under the covers of how modules are implemented. It appears there’s a fairly standard set of attributes, which are influenced by various keywords, config file settings, environment variables, and runtime conditions, and these attributes may influence to various degrees different aspects of modules’ operation. “Become” for example influences include\_vars not at all. ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [March 17, 2022, 7:33pm UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456/8 "2022-03-17T19:33:25Z")
Although your initial post amply demonstrates the problem you ran into, we can surmise that what you’re trying to accomplish is more interesting. Can we step back a bit and maybe up to a higher level and explore your actual use case? (I have a feeling the answer is going to involve ansible-vault. You’ve got me curious.) ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [March 17, 2022, 8:36pm UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456/9 "2022-03-17T20:36:15Z")
The 'usable' part is badly phrased, it won't error (yet) with become settings (from config/cli/keywords or vars) but it ignores them > Are you implying that it is not possible to include a vars file on the controller that require higher privileges than the user's permissions running the playbook? This is exactly the case One workaround, use a slurp task (with become) task to get the original file and dump it into a variable (or a file and then include\_vars if you cannot use the container variable). ---
**Author:** ![actionmystique](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/actionmystique/32/1678_2.png) [@actionmystique](https://forum.ansible.com/u/actionmystique)\ **Post date:** [March 17, 2022, 8:49pm UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456/10 "2022-03-17T20:49:04Z")
@uto…@gmail.com I just need to let the user running the playbook access files which cannot be accessed to any other user (except root of course).I’m very surprised that this limitation exist with that module. @Brian Coca I just don’t understand why the ansible team has decided that become keywords cannot affect include\_vars. It’s just a module that always runs on the controller, but what’s the difference with all other modules which are affected by become keywords but are delegated on the localhost? It just does not make any sense to me. Or maybe I’m missing a fundamental piece of the inner workings. ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [March 18, 2022, 12:05am UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456/11 "2022-03-18T00:05:09Z")
This slurp worked for me: ```auto - name: Slurp the file vars: ansible_become: yes ansible_become_method: sudo ansible_become_user: root slurp: src: "{{ restricted_file }}" delegate_to: "{{ controller_host }}" register: slop - name: Set a fact set_fact: slick: "{{ slop.content | b64decode | from_yaml }}" ``` I’m still curious, though, why there would be root-only vars files on your controller. ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [March 18, 2022, 12:22am UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456/12 "2022-03-18T00:22:20Z")
As to “why the ansible team has decided that become keywords cannot affect include\_vars”, I rather doubt it’s ever come up before. Internally, Ansible does _lots_ of including/importing vars files. I imagine it evolved as a simple way to let the user pick some snowflake that wasn’t one of the 20 or so sources of variables that Ansible already pulled in. For reasons I don’t see, you’ve got an extraordinary quirk (root-only access) on an already unusual case. Another approach you could try: Whatever rootly process that currently creates that file could end with an “ansible-vault encrypt …” operation on it (or a copy) that your controller process could be allowed to read. Or some variation on that theme. Good luck! ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [March 18, 2022, 8:19pm UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456/13 "2022-03-18T20:19:22Z")
@jean-chistophe manicot > I just don't understand why the ansible team has decided that become keywords cannot affect include\_vars. It's just a module that always runs on the controller, but what's the difference with all other modules which are affected by become keywords but are delegated on the localhost? It just does not make any sense to me. Or maybe I'm missing a fundamental piece of the inner workings. It was not as much a 'decision' as a 'consequence', include\_vars is NOT a module, it is an action plugin, both types work as 'task actions' but action plugins execute inside the ansible process on the controller while modules execute on a remote machine. We mostly hide this distinction from the user but it creates several issues like 'become doesn't affect action plugins', also why we recently added 'attributes' to inform people of long standing behaviors that were not noticed/ignored unless you hit a corner case like this. So yes, you were missing a piece of the inner workings, one that was purposefully hidden from users. 99% of the time this does not matter much, but this case ended up being in the 1%. ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [March 18, 2022, 8:21pm UTC](https://forum.ansible.com/t/how-to-use-include-vars-with-a-file-needing-elevated-privileges/36456/14 "2022-03-18T20:21:08Z")
one reason that this is an 'action' and not a module is that modules are not allowed to change the normal variables, only 'return facts', other actions like debug/includes/imports/add\_host/group\_by also modify 'ansilbe internal data' which for many reasons, security being just one, we don't allow modules to do.