# SmartOS/Illumos pfexec support

**URL:** <https://forum.ansible.com/t/smartos-illumos-pfexec-support/17510>\
**Category:** Ansible Project\
**Created:** [February 12, 2015, 9:39pm UTC](https://forum.ansible.com/t/smartos-illumos-pfexec-support/17510 "2015-02-12T21:39:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Preston\_Marshall](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@Preston\_Marshall](https://forum.ansible.com/u/Preston_Marshall)\
**Post date:** [February 12, 2015, 9:39pm UTC](https://forum.ansible.com/t/smartos-illumos-pfexec-support/17510/1 "2015-02-12T21:39:40Z")

</div>

Hi all, I am working on writing some Ansible playbooks to manage my SmartOS deployment. I’m using Illumos/SmartOS’s support for RBAC instead of sudo/su, but I’m running into some issues with it.

Basically I just need to run pfexec before each command so it executes with my user’s profiles (privileges). I was hoping ANSIBLE\_SUDO\_EXE or even ANSIBLE\_EXECUTABLE would help, but unfortunately pfexec does not accept the same (immutable) flags as sudo, and setting ANSIBLE\_EXECUTABLE to pfbash (basically like doing pfexec /bin/bash) causes PUTs to fail on the SSH level for some reason.

Adding pfexec support to Ansible seems like it would be a lot of work for not much gain, so I was considering writing a wrapper to pfexec to translate the sudo flags to pfexec flags. Has anyone else run into this or have any ideas on how to solve this better?

Thanks,  
Preston

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [February 13, 2015, 3:40pm UTC](https://forum.ansible.com/t/smartos-illumos-pfexec-support/17510/2 "2015-02-13T15:40:23Z")

</div>

I'm currently revamping the privilege escalation system to both  
generalize it and allow for easier addition of new systems. Once I  
have this working we can look into adapting pfexec.

---

<div class="post-metadata">

**Author:** ![Preston\_Marshall](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@Preston\_Marshall](https://forum.ansible.com/u/Preston_Marshall)\
**Post date:** [March 2, 2015, 10:53pm UTC](https://forum.ansible.com/t/smartos-illumos-pfexec-support/17510/3 "2015-03-02T22:53:21Z")

</div>

I ended up just [hacking in an if check](https://gist.github.com/bbhoss/58213f3bc9444f98cee1) to just execute things with pfexec instead of sudo with no flags, and it seems to work fine. I know it’s ugly but I figured I would at least mention it.

Thanks,  
Preston