SmartOS/Illumos pfexec support

Archives Ansible Project
1

Hi all, I am working on writing some Ansible playbooks to manage my SmartOS deployment. I’m using Illumos/SmartOS’s support for RBAC instead of sudo/su, but I’m running into some issues with it.

Basically I just need to run pfexec before each command so it executes with my user’s profiles (privileges). I was hoping ANSIBLE_SUDO_EXE or even ANSIBLE_EXECUTABLE would help, but unfortunately pfexec does not accept the same (immutable) flags as sudo, and setting ANSIBLE_EXECUTABLE to pfbash (basically like doing pfexec /bin/bash) causes PUTs to fail on the SSH level for some reason.

Adding pfexec support to Ansible seems like it would be a lot of work for not much gain, so I was considering writing a wrapper to pfexec to translate the sudo flags to pfexec flags. Has anyone else run into this or have any ideas on how to solve this better?

Thanks,
Preston

2

I'm currently revamping the privilege escalation system to both
generalize it and allow for easier addition of new systems. Once I
have this working we can look into adapting pfexec.

3

I ended up just hacking in an if check to just execute things with pfexec instead of sudo with no flags, and it seems to work fine. I know it’s ugly but I figured I would at least mention it.

Thanks,
Preston