# When sudo isn't enough ...

**URL:** <https://forum.ansible.com/t/when-sudo-isnt-enough/11706>\
**Category:** Ansible Project\
**Created:** [July 20, 2012, 5:48pm UTC](https://forum.ansible.com/t/when-sudo-isnt-enough/11706 "2012-07-20T17:48:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Steve\_Moyer](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@Steve\_Moyer](https://forum.ansible.com/u/Steve_Moyer)\
**Post date:** [July 20, 2012, 5:48pm UTC](https://forum.ansible.com/t/when-sudo-isnt-enough/11706/1 "2012-07-20T17:48:56Z")

</div>

I have an interesting edge case that I haven’t been able to solve and I was hoping someone smarter than I am had already conquered it.

I have a normal user account on a Linux host with sudo privileges, but my user directory is mounted via NFS (all user directories on all machines are like this). When I run a playbook, I use -u -k -sudo and -K and Ansible has no problem starting up. The script and arguments are copied into ~/.ansible/tmp/ without a problem since my normal user account owns my home directory.

So now the problem …

When Ansible executes sudo, the root account is NOT a user account on the NFS server (and isn’t known to our LDAP/Kerberos authentication), so it is denied permission to read/execute the arguments and script that was copied to the host. Is there some way to force an alternate location for these temporary files? I can create myself a directory in /tmp or elsewhere (not mounted via NFS) just fine but I’m not able to solve the permissions problem without making the .ansible directory world readable/executable.

Thanks,

smoyer

---

<div class="post-metadata">

**Author:** ![Timothy\_Appnel](https://avatars.discourse-cdn.com/v4/letter/t/e5b9ba/32.png) [@Timothy\_Appnel](https://forum.ansible.com/u/Timothy_Appnel)\
**Post date:** [July 22, 2012, 7:32am UTC](https://forum.ansible.com/t/when-sudo-isnt-enough/11706/2 "2012-07-22T07:32:09Z")

</div>

If you can use the environmental value ANSIBLE\_REMOTE\_TMP to override that default.

---

<div class="post-metadata">

**Author:** ![Steve\_Moyer](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@Steve\_Moyer](https://forum.ansible.com/u/Steve_Moyer)\
**Post date:** [July 22, 2012, 11:14am UTC](https://forum.ansible.com/t/when-sudo-isnt-enough/11706/3 "2012-07-22T11:14:54Z")

</div>

> Thanks Timothy!

I missed that reading through the documents.