# Recent addition of "-i" argument to sudo is reverted

**URL:** <https://forum.ansible.com/t/recent-addition-of-i-argument-to-sudo-is-reverted/12219>\
**Category:** Ansible Project\
**Created:** [January 20, 2013, 2:09pm UTC](https://forum.ansible.com/t/recent-addition-of-i-argument-to-sudo-is-reverted/12219 "2013-01-20T14:09:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\
**Post date:** [January 20, 2013, 2:09pm UTC](https://forum.ansible.com/t/recent-addition-of-i-argument-to-sudo-is-reverted/12219/1 "2013-01-20T14:09:08Z")

</div>

It seems this is hanging for various folks, and it's somewhat unclear  
why, so I reverted the commit.

Since we recently added a "default\_sudo\_exe" parameter for those using  
alternative environments, it may be reasonable to also have a  
"default\_sudo\_flags" for those that want to try to add things.

--Michael

---

<div class="post-metadata">

**Author:** ![fdavis](https://avatars.discourse-cdn.com/v4/letter/f/a698b9/32.png) [@fdavis](https://forum.ansible.com/u/fdavis)\
**Post date:** [January 20, 2013, 7:27pm UTC](https://forum.ansible.com/t/recent-addition-of-i-argument-to-sudo-is-reverted/12219/2 "2013-01-20T19:27:29Z")

</div>

I’m not sure if we want to pursue this, since the ‘default\_sudo\_flags’ looks more flexible and would help anyone using sudo alternatives, but here is what I’ve found on the “-i” issue.

I believe “-i” is causing the extra quoting to be stripped by running the command through an additional shell, so /usr/bin/python gets executed without arguments, which puts you in the interpreter, which causes it to hang. The /path/to/module ends up as a positional argument of /bin/sh (or the specified shell.)  
Details below.

I setup sudoers with logging this morning, and sudoreplay claims the command being run is this, (doesn’t appear to capture quoting)  
COMMAND=/bin/bash -c /bin/sh -c /usr/bin/python /home/fdavis/.ansible/tmp/ansible-1358657347.9-144116437520503/setup

That command from Ansible is,  
EXEC /bin/sh -c ‘sudo -k && sudo -S -p “[sudo via ansible, key=bpjzgikavtmldcsajwozygjxrftjzswr] password: " -i -u root /bin/sh -c '”’“‘/usr/bin/python /home/fdavis/.ansible/tmp/ansible-1358657347.9-144116437520503/setup’”‘"’’

Per ‘man /bin/sh’ the “-i” flag runs the shell specified in passwd for the sudo user, in my case it adds “/bin/bash”.  
It appears that the extra shell is absorbing the quotes around /path/to/python /path/to/module, and the /path/to/module becomes a $0 in the shell.

This is my understanding of where that module path is ending up:  
[fdavis@centos6 ~]$ /bin/sh -c ‘echo $0’ /home/fdavis/.ansible/tmp/ansible-1358657347.9-144116437520503/setup  
/home/fdavis/.ansible/tmp/ansible-1358657347.9-144116437520503/setup

I was able to run the following in my terminal with more quote magic, but I don’t know that it helps with anything but adding to the head scratching.  
/bin/sh -c ‘/bin/bash -c ‘'’/bin/sh -c ‘"’'’“‘/usr/bin/python /home/fdavis/.ansible/tmp/ansible-1358657347.9-144116437520503/setup’”‘'’"‘’'‘’

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\
**Post date:** [January 20, 2013, 9:17pm UTC](https://forum.ansible.com/t/recent-addition-of-i-argument-to-sudo-is-reverted/12219/3 "2013-01-20T21:17:50Z")

</div>

> I'm not sure if we want to pursue this, since the 'default\_sudo\_flags' looks  
> more flexible and would help anyone using sudo alternatives, but here is  
> what I've found on the "-i" issue.
> 
> I believe "-i" is causing the extra quoting to be stripped by running the  
> command through an additional shell, so /usr/bin/python gets executed  
> without arguments, which puts you in the interpreter, which causes it to  
> hang. The /path/to/module ends up as a positional argument of /bin/sh (or  
> the specified shell.)  
> Details below.

Nice legwork. And yeah, I agree with the flags suggestion. If we  
go further we can put a interpolation point for the command itself in  
there (like %{cmd}s) and people can play with extra quoting if they  
want.

Shell quoting is the #3 hardest problem in computer science! 🙂

---

<div class="post-metadata">

**Author:** ![Lorin\_Hochstein1](https://avatars.discourse-cdn.com/v4/letter/l/ce73a5/32.png) [@Lorin\_Hochstein1](https://forum.ansible.com/u/Lorin_Hochstein1)\
**Post date:** [January 20, 2013, 9:58pm UTC](https://forum.ansible.com/t/recent-addition-of-i-argument-to-sudo-is-reverted/12219/4 "2013-01-20T21:58:56Z")

</div>

The first two being cache invalidation and naming things:  
[http://www.martinfowler.com/bliki/TwoHardThings.html](http://www.martinfowler.com/bliki/TwoHardThings.html)

Lorin