# Using sudo as root **URL:** \ **Category:** Ansible Project\ **Created:** [April 4, 2014, 1:02pm UTC](https://forum.ansible.com/t/using-sudo-as-root/14937 "2014-04-04T13:02:01Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Dustin\_C\_Hatch](https://avatars.discourse-cdn.com/v4/letter/d/96bed5/32.png) [@Dustin\_C\_Hatch](https://forum.ansible.com/u/Dustin_C_Hatch)\ **Post date:** [April 4, 2014, 1:02pm UTC](https://forum.ansible.com/t/using-sudo-as-root/14937/1 "2014-04-04T13:02:01Z")
In my environment, when a VM is first provisioned, it has no users other than root, and root has no password. The machines are pre-seeded with an authorized SSH key so I can log in as root remotely to finish the set up. These machines have SELinux enforcing the strict policy, so even logging in as root is insufficient to make any changes, I have to use sudo to get to the sysadm\_r role. Unfortunately, it seems that Ansible thinks it is smarter than I am, and refuses to run my modules in sudo if the remote user is root, so everything fails with permission denied errors. Is there a way I can force or trick Ansible into running my plays through sudo, even when logged in as root? Note: one of the steps in my playbook is to set up another user that will be used for all subsequent Ansible runs; only the initial set up needs to be run as root. Dustin C. Hatch [http://dustin.hatch.name/](http://dustin.hatch.name/) ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [April 4, 2014, 3:16pm UTC](https://forum.ansible.com/t/using-sudo-as-root/14937/2 "2014-04-04T15:16:54Z")
“Unfortunately, it seems that Ansible thinks it is smarter than I am, and refuses to run my modules in sudo if the remote user is root, so everything fails with permission denied errors.” This is true because sudo to the same user causes problems on lots of systems. This is the first I’ve heard of sudo to root from root giving different behavior than being root. Can you share some more details about your SELinux policy configuration? ---
**Author:** ![Dustin\_C\_Hatch](https://avatars.discourse-cdn.com/v4/letter/d/96bed5/32.png) [@Dustin\_C\_Hatch](https://forum.ansible.com/u/Dustin_C_Hatch)\ **Post date:** [April 4, 2014, 3:42pm UTC](https://forum.ansible.com/t/using-sudo-as-root/14937/3 "2014-04-04T15:42:37Z")
It's the default Gentoo strict policy. Essentially the problem is that when root logs in via ssh, it gets staff\_r, and needs to transition to sysadm\_r in order to actually do anything. Normally, one would use newrole to do the transition, but since root has no password, it can't authenticate. These machines have the following entry in sudoers: root ALL = (ALL) ROLE=sysadm\_r TYPE=sysadm\_t ALL This allows root to transition to sysadm\_r in order to run commands, without needing to authenticate. It works perfectly from the command line, but since Ansible won't run through sudo, root can't get the sysadm\_r role. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [April 4, 2014, 6:09pm UTC](https://forum.ansible.com/t/using-sudo-as-root/14937/4 "2014-04-04T18:09:28Z")
Curious. Perhaps a global config setting for “prevent\_apparent\_useless\_sudo” is needed. IIRC, this caused problems with prompts in some cases – but maybe it didn’t and someone was optimizing something that didn’t need to be optimized. ---
**Author:** ![Dustin\_C\_Hatch](https://avatars.discourse-cdn.com/v4/letter/d/96bed5/32.png) [@Dustin\_C\_Hatch](https://forum.ansible.com/u/Dustin_C_Hatch)\ **Post date:** [April 4, 2014, 7:34pm UTC](https://forum.ansible.com/t/using-sudo-as-root/14937/5 "2014-04-04T19:34:08Z")
I'm guessing this was a configuration issue ([http://xkcd.com/1343/](http://xkcd.com/1343/)), and maybe Ansible should try to work around it by default, but it should not ignore what I've explicitly told it to do. If you're okay with a configuration setting to override this behavior, I'll try to get a patch that implements it. Dustin C. Hatch [http://dustin.hatch.name/](http://dustin.hatch.name/) ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [April 5, 2014, 1:54am UTC](https://forum.ansible.com/t/using-sudo-as-root/14937/6 "2014-04-05T01:54:04Z")
A config setting seems reasonable. I hate that I don’t remember how we got down this path, but I think there’s a good chance in some cases extra-sudo was causing issues for people.