# Understanding become\_user Privilege Escalation

**URL:** <https://forum.ansible.com/t/understanding-become-user-privilege-escalation/28337>\
**Category:** Ansible Project\
**Created:** [August 15, 2018, 8:49pm UTC](https://forum.ansible.com/t/understanding-become-user-privilege-escalation/28337 "2018-08-15T20:49:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://forum.ansible.com/u/amruth)\
**Post date:** [August 15, 2018, 8:49pm UTC](https://forum.ansible.com/t/understanding-become-user-privilege-escalation/28337/1 "2018-08-15T20:49:30Z")

</div>

Hi All,

I am trying to create a file in /opt folder. My playbook(from test role) looks like,

> * * *
> 
> - name: create file  
> file:  
> path: /opt/testfile  
> state: touch

And main.yml looks like,

> * * *
> 
> - hosts: ‘{{ host }}’  
> become: yes  
> become\_method: sudo  
> become\_user: jenkins  
> roles:
> - test

I am running the playbook as,

> ansible-playbook -i /tmp/ansible-workspace/environments/QA/inventory --extra-vars “host=QA” --ask-pass --ask-become-pass main.yml -vvv

And the error I get is,

“mode”: “0644”,  
“msg”: “Error while touching existing target: [Errno 13] Permission denied: ‘/opt/testfile’”,  
“owner”: “root”,  
“path”: “/opt/testfile”,  
“secontext”: “unconfined\_u:object\_r:etc\_t:s0”,  
“size”: 0,  
“state”: “file”,  
“uid”: 0

But when I comment out the line become\_user: jenkins in main.yml and run it with the command

> ansible-playbook -i /tmp/ansible-workspace/environments/QA/inventory --extra-vars “host=QA” -u jenkins --ask-pass --ask-become-pass main.yml -vvv

it works perfectly fine.

Can someone please say teh differnce between the two ways?

Thanks

---

<div class="post-metadata">

**Author:** ![klaasdemter](https://avatars.discourse-cdn.com/v4/letter/k/3bc359/32.png) [@klaasdemter](https://forum.ansible.com/u/klaasdemter)\
**Post date:** [August 15, 2018, 9:05pm UTC](https://forum.ansible.com/t/understanding-become-user-privilege-escalation/28337/2 "2018-08-15T21:05:14Z")

</div>

[https://docs.ansible.com/ansible/latest/user\_guide/become.html](https://docs.ansible.com/ansible/latest/user_guide/become.html)  
-u and become\_user don't do the same. One time you create the file as root and other time as jenkins user.

Greetings  
Klaas

---

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://forum.ansible.com/u/amruth)\
**Post date:** [August 19, 2018, 8:35pm UTC](https://forum.ansible.com/t/understanding-become-user-privilege-escalation/28337/3 "2018-08-19T20:35:56Z")

</div>

Thanks Klaas!

But jenkins user is a sudo user on the remote machine. Why does it have to throw error “Error while touching existing target: [Errno 13] Permission denied: ‘/opt/testfile’” when sudo user has permission to create files in /opt folder.

Also, I tried creating file in /opt folder manually(not through Ansible) and I was able to create file without any issues.

Could you please clarify?

---

<div class="post-metadata">

**Author:** ![Pandu\_jh](https://avatars.discourse-cdn.com/v4/letter/p/3bc359/32.png) [@Pandu\_jh](https://forum.ansible.com/u/Pandu_jh)\
**Post date:** [August 20, 2018, 9:19am UTC](https://forum.ansible.com/t/understanding-become-user-privilege-escalation/28337/4 "2018-08-20T09:19:16Z")

</div>

Need below info.

1. Can you paste here, sudo entry lines of jenkins user from sudoers file.
2. From which user id you are executing the playbook?

---

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://forum.ansible.com/u/amruth)\
**Post date:** [August 20, 2018, 2:53pm UTC](https://forum.ansible.com/t/understanding-become-user-privilege-escalation/28337/5 "2018-08-20T14:53:27Z")

</div>

Hi Pandu,

1. jenkins user is added to the wheel group(but not a password less sudo). My aim is to create a playbook where it gets connected to the remote machines and add ssh keys for password less ssh and add a line entry to sudoers file for password less sudo.
2. I am executing playbook with the same user jenkins