{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible/issues/10805","labels_url":"https://api.github.com/repos/ansible/ansible/issues/10805/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible/issues/10805/comments","events_url":"https://api.github.com/repos/ansible/ansible/issues/10805/events","html_url":"https://github.com/ansible/ansible/issues/10805","id":69909450,"number":10805,"title":"sudo_exe with pbrun adding -k option","user":{"login":"mklumpp1","id":1509568,"avatar_url":"https://avatars.githubusercontent.com/u/1509568?v=3","gravatar_id":"","url":"https://api.github.com/users/mklumpp1","html_url":"https://github.com/mklumpp1","followers_url":"https://api.github.com/users/mklumpp1/followers","following_url":"https://api.github.com/users/mklumpp1/following{/other_user}","gists_url":"https://api.github.com/users/mklumpp1/gists{/gist_id}","starred_url":"https://api.github.com/users/mklumpp1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mklumpp1/subscriptions","organizations_url":"https://api.github.com/users/mklumpp1/orgs","repos_url":"https://api.github.com/users/mklumpp1/repos","events_url":"https://api.github.com/users/mklumpp1/events{/privacy}","received_events_url":"https://api.github.com/users/mklumpp1/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ansible/ansible/labels/bug_report","name":"bug_report","color":"fbca04"},{"url":"https://api.github.com/repos/ansible/ansible/labels/P3","name":"P3","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2015-04-21T17:44:56Z","updated_at":"2015-05-01T20:20:37Z","closed_at":null,"body":"Hi, \r\nthanks for providing the pbrun functionality as sudo_exe for ansible, I was looking forward to it so that we can use it as part of our ops process. \r\n\r\nI'm using password over ssh, keys are not an option and I have setup the config as:\r\n[defaults]\r\nask_pass=True\r\nsudo_exe=/usr/local/bin/pbrun \"/bin/su -\"\r\nsudo_flags=\r\n\r\nThe resulting stack from -vvvv is:\r\nSSH password:\r\n\r\nPLAY [Setup] *************************************************************\r\n\r\nGATHERING FACTS ***************************************************************\r\n<xxx> ESTABLISH CONNECTION FOR USER: aaa\r\n<xxx> REMOTE_MODULE setup\r\n<xxx> EXEC sshpass -d4 ssh -C -tt -vvv -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=\"/root/.ansible/cp/ansible-ssh-%h-%p-%r\" -o GSSAPIAuthentication=no -o PubkeyAuthentication=no -o User=aaa -o ConnectTimeout=10 xxx /bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1429636397.35-212799669152196 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1429636397.35-212799669152196 && echo $HOME/.ansible/tmp/ansible-tmp-1429636397.35-212799669152196'\r\n<xxx> PUT /tmp/tmpFm7FLw TO /adshome/aaa/.ansible/tmp/ansible-tmp-1429636397.35-212799669152196/setup\r\n<xxx> EXEC sshpass -d4 ssh -C -tt -vvv -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=\"/root/.ansible/cp/ansible-ssh-%h-%p-%r\" -o GSSAPIAuthentication=no -o PubkeyAuthentication=no -o User=aaa -o ConnectTimeout=10 xxx /bin/sh -c '/usr/local/bin/pbrun \"/bin/su -\" -k && /usr/local/bin/pbrun \"/bin/su -\" -S -p \"[sudo via ansible, key=ssss] password: \" -u root /bin/sh -c '\"'\"'echo BECOME-SUCCESS-sss; LANG=en_US.UTF-8 LC_CTYPE=en_US.UTF-8 /usr/bin/python /adshome/aaa/.ansible/tmp/ansible-tmp-1429636397.35-212799669152196/setup; rm -rf /adshome/aaa/.ansible/tmp/ansible-tmp-1429636397.35-212799669152196/ >/dev/null 2>&1'\"'\"''\r\nfailed: [xxx] => {\"failed\": true, \"parsed\": false}\r\n\r\nRejected.  That command is not permitted by the PowerBroker policy\r\nfor your group (Evaluated 1 records).\r\n\r\nFor assistance:\tpbrun -p mypolicy | more\r\n\r\nUser:\taaa\r\nRunhost:\txxx\r\nGroup:\tz\r\nDate and Time:\t2015/04/21 10:22:46\r\nCommand:\t/bin/su - -k\r\n\r\nOpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: Applying options for *\r\ndebug1: auto-mux: Trying existing master\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug2: mux_client_hello_exchange: master version 4\r\ndebug3: mux_client_request_forwards: requesting forwardings: 0 local, 0 remote\r\ndebug3: mux_client_request_session: entering\r\ndebug3: mux_client_request_alive: entering\r\ndebug3: mux_client_request_alive: done pid = 11631\r\ndebug3: mux_client_request_session: session request sent\r\ndebug1: mux_client_request_session: master session id: 2\r\ndebug1: mux_client_request_session: master session id: 2\r\ndebug3: mux_client_read_packet: read header failed: Broken pipe\r\ndebug2: Received exit status from master 127\r\nShared connection to xxx closed.\r\n\r\nIt looks like -k gets added above.\r\n\r\nNot sure why that is the case, I'm on RHEL6, ansible 1.9.0.1.\r\n\r\nThe debug above states the commands as:  /bin/sh -c '/usr/local/bin/pbrun \"/bin/su -\" -k && /usr/local/bin/pbrun \"/bin/su -\" -S -p\r\nRemoving the quotes around sudo_exe's to /bin/su -, produces the same result\r\n\r\nThanks for your help!"},"comment":{"url":"https://api.github.com/repos/ansible/ansible/issues/comments/98224090","html_url":"https://github.com/ansible/ansible/issues/10805#issuecomment-98224090","issue_url":"https://api.github.com/repos/ansible/ansible/issues/10805","id":98224090,"user":{"login":"bcoca","id":836171,"avatar_url":"https://avatars.githubusercontent.com/u/836171?v=3","gravatar_id":"","url":"https://api.github.com/users/bcoca","html_url":"https://github.com/bcoca","followers_url":"https://api.github.com/users/bcoca/followers","following_url":"https://api.github.com/users/bcoca/following{/other_user}","gists_url":"https://api.github.com/users/bcoca/gists{/gist_id}","starred_url":"https://api.github.com/users/bcoca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcoca/subscriptions","organizations_url":"https://api.github.com/users/bcoca/orgs","repos_url":"https://api.github.com/users/bcoca/repos","events_url":"https://api.github.com/users/bcoca/events{/privacy}","received_events_url":"https://api.github.com/users/bcoca/received_events","type":"User","site_admin":false},"created_at":"2015-05-01T20:20:37Z","updated_at":"2015-05-01T20:20:37Z","body":"My policy allows my user to run everything as root, I mostly tested with\nshell: whoami and verifying that it returns root.\n\nansible uses all privilege escalation at a 'global' level to run all kinds\nof intermediate commands, so be it sudo or powerbroker it does not work\nwith fine grained permissions.\n\nremoving some testing stuff this is the basic file:\nif (user == \"bcoca\") {\n   # set the user runtime properties of the delegated command and PATH\n   runuser = \"root\";\n   setenv(\"PATH\",\n\"/bin:/usr/bin:/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin\");\n   accept;\n}\n\n-- \nBrian Coca\n"}}