# Systemd exact commands for sudoers file

**URL:** <https://forum.ansible.com/t/systemd-exact-commands-for-sudoers-file/8366>\
**Category:** Get Help\
**Tags:** systemd\
**Created:** [September 9, 2024, 2:35pm UTC](https://forum.ansible.com/t/systemd-exact-commands-for-sudoers-file/8366 "2024-09-09T14:35:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nilshee](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/nilshee/32/4677_2.png) [@nilshee](https://forum.ansible.com/u/nilshee)\
**Post date:** [September 9, 2024, 2:35pm UTC](https://forum.ansible.com/t/systemd-exact-commands-for-sudoers-file/8366/1 "2024-09-09T14:35:45Z")

</div>

Hello everyone,

I’m currently trying to update a couple of configuration scripts of a server.  
The steps I want to do:

1. Stop service
2. Copy new configuration files for this service
3. Start service

I have a sudoers file that allows the remote user to run systemctl start/stop/show/status for this specific service.  
The sudoers file:

```auto
%REDACTED ALL= NOPASSWD: /bin/systemctl start REDACTED
%REDACTED ALL= NOPASSWD: /bin/systemctl stop REDACTED
%REDACTED ALL= NOPASSWD: /bin/systemctl restart REDACTED
%REDACTED ALL= NOPASSWD: /bin/systemctl status REDACTED
%REDACTED ALL= NOPASSWD: /bin/systemctl show

```

The problem is now that the commands in the sudoers file most likely not fit the commands ansible is using.  
The task I want to run is:

```auto
    - name: "Stop service {{ service_name }}"
      ansible.builtin.systemd_service:
        name: "{{ service_name }}"
        state: stopped
      become: true

```

It fails with “password required”. The question is now, is there a way to edit the sudoers file to have ansible working without giving NOPASSWD Permissions on every command for the remote user?  
Using ansible.builtin.command it works

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [September 9, 2024, 4:21pm UTC](https://forum.ansible.com/t/systemd-exact-commands-for-sudoers-file/8366/2 "2024-09-09T16:21:07Z")

</div>

You may also need:

```auto
%REDACTED ALL= NOPASSWD: /bin/systemctl show 'REDACTED'
%REDACTED ALL= NOPASSWD: /bin/systemctl list-unit-files *
%REDACTED ALL= NOPASSWD: /bin/systemctl is-active 'REDACTED'

```

since the module first checks to see if the specified unit _exists_ before attempting to make any required changes. Note also the `'` characters, as sudo rules without any wildcards must be exact matches, and the module is single quoting the given unit name. I did use a wildcard for `list-unit-files`, but that’s because I’m not sure how to easily interpret the following `'{unit_search}*'`, since it’s a manipulation of the original unit name. The single-quotes around the unit name are also used by the module for all of the start/stop/restart/reload actions.

Additionally, I’m not familiar enough with sudo rules to know if it cares about symlink paths. Usually, `/bin` and `/usr/bin` are symlinked, and Ansible isn’t using an explicit path to `systemctl`, so Ansible might be trying to use `/usr/bin/systemctl` while all of your rules are for `/bin/systemctl`. This might be an important distinction for the sudo rules.

Edit: for reference: [ansible/lib/ansible/modules/systemd\_service.py at devel · ansible/ansible (github.com)](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/systemd_service.py)

---

<div class="post-metadata">

**Author:** ![nilshee](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/nilshee/32/4677_2.png) [@nilshee](https://forum.ansible.com/u/nilshee)\
**Post date:** [September 10, 2024, 8:54am UTC](https://forum.ansible.com/t/systemd-exact-commands-for-sudoers-file/8366/3 "2024-09-10T08:54:44Z")

</div>

Unfortunately it seems to just not work. The become does not prepend the sudo to each command but to the whole python command which is used for the subcommand e.g.:

```auto
sudo -H -S -n -u root /bin/sh -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-htbihlgskndrxzpaectqhiopugwdsxww ; /usr/bin/python3 /home/USER/.ansible/tmp/ansible-tmp-1725957415.6666732-2937536-137956451165161/AnsiballZ_systemd_service.py'"'"'"'"'"'"'"'"' && sleep 0

```

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [September 10, 2024, 4:21pm UTC](https://forum.ansible.com/t/systemd-exact-commands-for-sudoers-file/8366/4 "2024-09-10T16:21:50Z")

</div>

Assuming modules will just use a specific command is not really possible, hence why:

[https://docs.ansible.com/ansible/latest/playbook\_guide/playbooks\_privilege\_escalation.html#privilege-escalation-must-be-general](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_privilege_escalation.html#privilege-escalation-must-be-general)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [October 10, 2024, 4:22pm UTC](https://forum.ansible.com/t/systemd-exact-commands-for-sudoers-file/8366/5 "2024-10-10T16:22:44Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.