# Privilege escalation - sudo error ansible.posix.sysctl **URL:** \ **Category:** Get Help\ **Created:** [September 13, 2024, 8:11am UTC](https://forum.ansible.com/t/privilege-escalation-sudo-error-ansible-posix-sysctl/8482 "2024-09-13T08:11:35Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![pepite](https://avatars.discourse-cdn.com/v4/letter/p/b487fb/32.png) [@pepite](https://forum.ansible.com/u/pepite)\ **Post date:** [September 13, 2024, 8:11am UTC](https://forum.ansible.com/t/privilege-escalation-sudo-error-ansible-posix-sysctl/8482/1 "2024-09-13T08:11:35Z")
Hi everybody, i need help please 😉 about **escalation with sudo** and the module **ansible.posix.sysctl** **In host\_vars file :** ```auto ansible_user : admabord ansible_password : xxxxx ansible_become_user: admtech ansible_become_password: xxxxx ansible_become_method: sudo ``` In roles, `tasks/main.yml` ```auto - name: Adjust value vm.swappiness become: true ansible.posix.sysctl: name: vm.swappiness value: '1' state: present sysctl_set: true reload: true register: swap ignore_errors: true - name: Debug vm.swappiness # Comment ansible.builtin.debug: msg: - "{{ swap }}" ``` **In sudoers on remote server** `admtech ALL = NOPASSWD: ALL` **on remote server this is ok when use defaults ansible become flags** 🙂 ```auto [admabord] $ sudo -H -S -p "xxxxxx" -u admtech /bin/sh -c "sudo touch /etc/test_file2" [admabord] $ ll /etc/ |grep file2 -rw-r--r--. 1 root root 0 13 sept. 10:02 test_file2 ``` or this is OK too `[admabord] $ sudo -H -S -p "admabord" -u admtech /bin/sh -c "sudo vi /etc/sysctl.conf"` the file sysctl.conf opened and i can write and save it ```auto # sysctl settings are defined through files in # /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/. # # Vendors settings live in /usr/lib/sysctl.d/. # To override a whole file, create a new file with the same in # /etc/sysctl.d/ and put new settings there. To override # only specific settings, add a file with a lexically later # name in /etc/sysctl.d/ and put new settings there. # # For more information, see sysctl.conf(5) and sysctl.d(5). net.ipv4.conf.all.rp_filter = 0 net.ipv4.conf.default.rp_filter = 0 ``` But this error appear with the tasks `"msg": "setting vm.swappiness failed: sysctl: permission denied on key 'vm.swappiness'\n"` I dont find what is my mistake 😉 Is anybody has an idea please 🙂 Thanks, Best regards ---
**Author:** ![RayJin2000](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/rayjin2000/32/3641_2.png) [@RayJin2000](https://forum.ansible.com/u/RayJin2000)\ **Post date:** [September 13, 2024, 8:39am UTC](https://forum.ansible.com/t/privilege-escalation-sudo-error-ansible-posix-sysctl/8482/2 "2024-09-13T08:39:34Z")
Have you tested any other task on this host with sudo, like creating a dir? Have you tried changing `vm.swappiness` by hand? ```auto sudo sysctl vm.swappiness=1 ``` Maybe you cant change it: [swap - Permission denied when changing swappiness - Ask Ubuntu](https://askubuntu.com/questions/744823/permission-denied-when-changing-swappiness) ---
**Author:** ![pepite](https://avatars.discourse-cdn.com/v4/letter/p/b487fb/32.png) [@pepite](https://forum.ansible.com/u/pepite)\ **Post date:** [September 13, 2024, 9:12am UTC](https://forum.ansible.com/t/privilege-escalation-sudo-error-ansible-posix-sysctl/8482/3 "2024-09-13T09:12:09Z")
Thanks for the answer @RayJin2000 Yes i retry for being sure 🙂 ```auto [admabord] $ sudo -H -S -p "xxxxx" -u admtech /bin/sh -c "sudo mkdir -p /etc/testdir" [admabord] $ ll /etc/ |grep dir drwxr-xr-x. 2 root root 6 13 sept. 11:09 testdir [admabord] $ sudo -H -S -p "xxxxxx" -u admtech /bin/sh -c "sudo sysctl vm.swappiness" vm.swappiness = 15 ``` ---
**Author:** ![RayJin2000](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/rayjin2000/32/3641_2.png) [@RayJin2000](https://forum.ansible.com/u/RayJin2000)\ **Post date:** [September 13, 2024, 9:27am UTC](https://forum.ansible.com/t/privilege-escalation-sudo-error-ansible-posix-sysctl/8482/4 "2024-09-13T09:27:46Z")
I meant, have you tried creating a directory with **ansible**? Maybe you need to change some of the default [ansible\_sudo\_\*](https://docs.ansible.com/ansible/latest/collections/environment_variables.html#envvar-ANSIBLE_SUDO_EXE) Envvars ---
**Author:** ![pepite](https://avatars.discourse-cdn.com/v4/letter/p/b487fb/32.png) [@pepite](https://forum.ansible.com/u/pepite)\ **Post date:** [September 13, 2024, 12:20pm UTC](https://forum.ansible.com/t/privilege-escalation-sudo-error-ansible-posix-sysctl/8482/5 "2024-09-13T12:20:36Z")
You agree, i have the same error for creating directory in /etc with the become I trie to change the flags but nothing is ok actually i try this too become\_flags: -s but KO with ansible and OK in CLI on the remote ---
**Author:** ![pepite](https://avatars.discourse-cdn.com/v4/letter/p/b487fb/32.png) [@pepite](https://forum.ansible.com/u/pepite)\ **Post date:** [September 13, 2024, 12:51pm UTC](https://forum.ansible.com/t/privilege-escalation-sudo-error-ansible-posix-sysctl/8482/6 "2024-09-13T12:51:13Z")
Hi 🙂 And this works 🙂 ```auto - name: Return motd to registered var become: true ansible.builtin.command: sudo touch /etc/sysctl.d/test_ansible.conf ``` Is anybody know how use sudo with a module like file for doing the same thing as command module ---
**Author:** ![RayJin2000](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/rayjin2000/32/3641_2.png) [@RayJin2000](https://forum.ansible.com/u/RayJin2000)\ **Post date:** [September 16, 2024, 7:26am UTC](https://forum.ansible.com/t/privilege-escalation-sudo-error-ansible-posix-sysctl/8482/7 "2024-09-16T07:26:07Z")
```auto - name: Touch a file ansible.builtin.file: path: /etc/foo.conf state: touch mode: u=rw,g=r,o=r ``` [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/file\_module.html](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/file_module.html)