# Templating sudoers - what could possibly go wrong...

**URL:** <https://forum.ansible.com/t/templating-sudoers-what-could-possibly-go-wrong/12015>\
**Category:** Ansible Project\
**Created:** [October 22, 2012, 4:07pm UTC](https://forum.ansible.com/t/templating-sudoers-what-could-possibly-go-wrong/12015 "2012-10-22T16:07:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nigel\_Metheringham](https://avatars.discourse-cdn.com/v4/letter/n/3ec8ea/32.png) [@Nigel\_Metheringham](https://forum.ansible.com/u/Nigel_Metheringham)\
**Post date:** [October 22, 2012, 4:07pm UTC](https://forum.ansible.com/t/templating-sudoers-what-could-possibly-go-wrong/12015/1 "2012-10-22T16:07:05Z")

</div>

It looks very much as though, currently, doing this:-

&nbsp;&nbsp;- name: Build sudo config file  
&nbsp;&nbsp;&nbsp;&nbsp;action: template src=templates/sudo/sudoers.j2 dest=/etc/sudoers  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;owner=root group=root mode=0440

leads to much pain and suffering, because template, uses copy, which  
chains file to deal with permissions etc....  
And when file runs, sudoers has been put in place with a default  
permission (0644 in this case), and sudo then refuses to run because the  
permissions are not as it expects 🙂

I'm hoping that the performance speedups for 0.9, which move file into  
common and reduce the round trips, will have the side effect of fixing  
this pain point 🙂

&nbsp;&nbsp;Nigel.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\
**Post date:** [October 22, 2012, 4:35pm UTC](https://forum.ansible.com/t/templating-sudoers-what-could-possibly-go-wrong/12015/2 "2012-10-22T16:35:32Z")

</div>

Most people have no problems at all doing templating with sudo set in 0.8.

There's an open ticket though on making copy change attribs prior to the move.

---

<div class="post-metadata">

**Author:** ![Peter\_Sankauskas](https://avatars.discourse-cdn.com/v4/letter/p/ea666f/32.png) [@Peter\_Sankauskas](https://forum.ansible.com/u/Peter_Sankauskas)\
**Post date:** [October 22, 2012, 6:15pm UTC](https://forum.ansible.com/t/templating-sudoers-what-could-possibly-go-wrong/12015/3 "2012-10-22T18:15:13Z")

</div>

Yep, this is the exact issue that  
[https://github.com/ansible/ansible/issues/1258](https://github.com/ansible/ansible/issues/1258)  
is going to resolve.

---

<div class="post-metadata">

**Author:** ![Nigel\_Metheringham](https://avatars.discourse-cdn.com/v4/letter/n/3ec8ea/32.png) [@Nigel\_Metheringham](https://forum.ansible.com/u/Nigel_Metheringham)\
**Post date:** [October 22, 2012, 7:05pm UTC](https://forum.ansible.com/t/templating-sudoers-what-could-possibly-go-wrong/12015/4 "2012-10-22T19:05:56Z")

</div>

Michael DeHaan wrote:

> Most people have no problems at all doing templating with sudo set in 0.8.

Well this was against a vanilla Centos 6 install. I saw the same thing  
with 0.7 (problem today was on 0.8 - which I think changed the template  
result so that the copy operation was repeated).

&nbsp;&nbsp;Nigel.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\
**Post date:** [October 22, 2012, 7:12pm UTC](https://forum.ansible.com/t/templating-sudoers-what-could-possibly-go-wrong/12015/5 "2012-10-22T19:12:41Z")

</div>

Yeah IIRC generally not an issue except for the linked sudoers example.