# Restricting Commands after privilege escalation using sudo in ansible.

**URL:** <https://forum.ansible.com/t/restricting-commands-after-privilege-escalation-using-sudo-in-ansible/33049>\
**Category:** Ansible Project\
**Created:** [May 29, 2020, 10:33am UTC](https://forum.ansible.com/t/restricting-commands-after-privilege-escalation-using-sudo-in-ansible/33049 "2020-05-29T10:33:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![varun\_mohan](https://avatars.discourse-cdn.com/v4/letter/v/71e660/32.png) [@varun\_mohan](https://forum.ansible.com/u/varun_mohan)\
**Post date:** [May 29, 2020, 10:33am UTC](https://forum.ansible.com/t/restricting-commands-after-privilege-escalation-using-sudo-in-ansible/33049/1 "2020-05-29T10:33:20Z")

</div>

Hi,  
Currently ansible uses wrapper scripts(shell/python) for executing commands as privileged user suing sudo. Due to this its currently not possible to restrict what commands ansible fires on the remote machine after privilege escalation. Main reason being ansible required NO PASSWD:ALL or NO PASSwd:/bin/sh( which is equivalent to NO PASSWD:ALL). Is there any way to control this.

Regards  
Varun

---

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [May 29, 2020, 10:46am UTC](https://forum.ansible.com/t/restricting-commands-after-privilege-escalation-using-sudo-in-ansible/33049/2 "2020-05-29T10:46:16Z")

</div>

No: [https://docs.ansible.com/ansible/latest/user\_guide/become.html#privilege-escalation-must-be-general](https://docs.ansible.com/ansible/latest/user_guide/become.html#privilege-escalation-must-be-general)