The pfexec become plugin has had incorrect defaults since it was
migrated from Ansible core, making it unusable on illumos without
manual workarounds:
1. become_flags defaulted to '-H -S -n' which are sudo flags.
pfexec does not accept any of these options, causing:
'exec: illegal option -- H'
2. wrap_exe defaulted to false. Unlike sudo, pfexec does not
interpret shell constructs internally. Since Ansible generates
compound commands (echo BECOME-SUCCESS-xxx ; python3), these
must be wrapped in /bin/sh -c for pfexec to execute them.
These issues were originally reported in 2016 (ansible/ansible#15642),
migrated to community.general as #3671, and partially fixed by PR #3889
in 2022 (which corrected quoting but not the defaults). Users have had
to work around this with explicit inventory settings ever since.
Changes:
- become_flags default: '-H -S -n' -> '' (empty)
- wrap_exe default: false -> true
- build_become_command: handle empty flags cleanly
- Updated tests to match corrected defaults
- Added test for custom flags
- Improved wrap_exe description to explain why it should be enabled
* Adjust all __future__ imports:
for i in $(grep -REl "__future__.*absolute_import" plugins/ tests/); do
sed -e 's/from __future__ import .*/from __future__ import annotations/g' -i $i;
done
* Remove all UTF-8 encoding specifications for Python source files:
for i in $(grep -REl '[-][*]- coding: utf-8 -[*]-' plugins/ tests/); do
sed -e '/^# -\*- coding: utf-8 -\*-/d' -i $i;
done
* Remove __metaclass__ = type:
for i in $(grep -REl '__metaclass__ = type' plugins/ tests/); do
sed -e '/^__metaclass__ = type/d' -i $i;
done
* fix: sudosu not working on some BSD machines
* fix: sudosu: added a flag (`alt_method`) to enhance compatibility with more versions of `su`
* Update changelogs/fragments/8214-sudosu-not-working-on-some-BSD-machines.yml
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update plugins/become/sudosu.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update plugins/become/sudosu.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update plugins/become/sudosu.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update plugins/become/sudosu.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* fix: sudosu: lint
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
* lint and fix polkit examples
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* add changelog fragment
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* remove changelog fragment
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---------
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* add systemd run0 as a become method
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* add fragment
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* remove space after hyphen
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* replace ansible with collection version
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* update version_added and remove changelog fragment
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* update formating
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* add types
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* slim super()
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* imports must appear below docs
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* add initial unit test
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* update unit tests
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---------
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
* Experimental change from OpenIndiana
* resolve pfexec problem, by removing superfluous quotes
* reimplement "wrap_exe"
* remove spaces arround keyword argument assignment
* adapted pfexec unit test
* Try to fix quoting of test expression
* Fix quoting of test expression by replacing ' with "
* Add changelog fragment
* Move licenses to LICENSES/, run add-license.py, add LICENSES/MIT.txt.
* Replace 'Copyright:' with 'Copyright'
sed -i 's|Copyright:\(.*\)|Copyright\1|' $(rg -l 'Copyright:')
Co-authored-by: Maxwell G <gotmax@e.email>
* added password prompt support for machinectl
* include review comments
This includes the review comments as well as changelog fragment. This also gives more information about the polkit rule.
* fix yaml doc with leftover bracket
* include review comments 2
* move regex compile to global scope
* Add support for `sudo su -` using password auth
Allow users to run Ansible tasks through `sudo su -` using password auth
- Feature Pull Request
sudosu
So I have been using this at various customers for bootstrapping Ansible mostly.
Often you have an existing setup where there is a user that has root-access enabled through sudo, but only to run `su` to log using the user's password.
In these specific cases the root password is unique to the system and therefore not an easy way to automate bootstrapping.
Having a `sudo su -` become option **with password prompt** is not possible with the existing become methods (neither sudo nor su can be used) by abusing `become_exe` or `become_flags`.
This fixesansible/ansible#12686
* Fix all reported issues
* Add unit tests
* Apply suggestions from code review
* Update plugins/become/sudosu.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update tests/unit/plugins/become/test_sudosu.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update tests/unit/plugins/become/test_sudosu.py
Co-authored-by: Felix Fontein <felix@fontein.de>
Co-authored-by: Felix Fontein <felix@fontein.de>
* Fix deprecation of callables.
* Fix various sanity errors.
* Revert callback_type -> type transform.
* Fix stat_result times: these are float according to https://github.com/python/typeshed/blob/master/stdlib/3/os/__init__.pyi
* Apply suggestions from code review
Co-authored-by: Andrew Klychkov <aaklychkov@mail.ru>
Co-authored-by: Andrew Klychkov <aaklychkov@mail.ru>
* doas: properly set the default values
The module expects by default:
- `become_user` to be `None` or a string,
- `become_flags` to by an empty string.
* Apply suggestions from code review
Co-authored-by: Felix Fontein <felix@fontein.de>
Co-authored-by: Felix Fontein <felix@fontein.de>
* Fix become plugins.
* Fix become unit tests to avoid play_context.make_become_cmd.
* Remove hack.
* Remove explicit defaults. Adjust tests to be more like Ansible itself.
* Forgot two lines.
* Rewrite tests (again).
* Rename play_context -> task, add possibility to pass var_options.
* Add var_options variants.
* Properly test overwriting.
