How do you simulate "sudo su <user>" in Ansible?

Question

I have a server where my user is able to sudo to the root user without a password, and then the root user can sudo to a third user without a password. However, my user cannot sudo directly to the third user without a password.

Ansible's become directive uses sudo in the traditional manner, i.e. the one that requires prompting for my password.

I've tried putting become_user: root on a block and become_user: <other-user> on a task inside that block, but it appears Ansible overrides the block's definition, rather than nesting the sudo calls as I hoped.

Note: this question has also been asked on StackOverflow, but since there's no solution I figured I would repost it here, which I think is the better site for it.

Answer 1

I met the same situation. I have login1 for my machine, passwordless sudo and login2, under which I should perform some actions. I did not solve it by ansible means. But I made such a workaround:

- name: "Install nvm"
  shell: sudo -u buildkite-agent bash -c "<my commands to be performed on behalf of buildkite-agent>"
  become: true

Such a case:

- name: "Install nvm"
  shell: sudo -u buildkite-agent <my commands to be performed on behalf of buildkite-agent>
  become: true

do not change home to buildkite-agent's home, i.e. uses /root as home.

Answer 2

Become super user at the play level and become another user at the task level:

- hosts: all
  become: yes
  tasks:

    - file:
        path: /tmp/test
        state: touch
      become_user: www-data

Validation:

$ ls -l /tmp | grep test
-rw-r--r-- 1 www-data www-data    0 Mär 10 14:08 test

For very simple cases, a workaround like the following could also help, but this doesn't really scale, as you cannot use ansible modules with this strategy:

- name: test
  command: "sudo -u www-data whoami"
  become: true

Output (extract): "stdout": "www-data"

Answer 3

What I did that worked for me :

- name: launch pg_ctl start
  command: "su <USER> -l -c '<COMMAND>'"
  become: yes
  become_exe: sudo

PS : With su -l, it automatically load the .bash_profile and not the .bashrc

Answer 4

For example you want to create a file you can use :

 name: Create file
 shell: "touch abc"
 become_user: <username>
 become: yes

This is equivalent to :: sudo su username -c "touch abc"