Access --ask-become-pass value in task

user_6196947 0
Viewed 38

Is there a way to access the value passed to the prompt when the flags --ask-become-pass or -u are used?
The objective is for the following task to check whether privilege escalation is correctly set up:

- debug:
    var: become_pass
- debug:
    var: ansible_remote_user
- name: Fail if no become_pass is set
  ansible.builtin.fail:
    msg: "User {{remote_user}} is not root and become password is not set. Try using '--ask-become-pass' when executing this playbook."
  when: remote_user != 'root' and become_pass is not defined

The output:

TASK [debug] ***********************************************************************************************************************************************************************************************************************
ok: [my-host] => {
    "become_pass": "VARIABLE IS NOT DEFINED!"
}

TASK [debug] ***********************************************************************************************************************************************************************************************************************
ok: [my-host] => {
    "ansible_remote_user": "VARIABLE IS NOT DEFINED!"
}

TASK [Fail if no become_pass is set] ***********************************************************************************************************************************************************************************************
fatal: [my-host]: FAILED! => {"msg": "The conditional check 'remote_user != 'root' and become_pass is not defined' failed. The error was: error while evaluating conditional (remote_user != 'root' and become_pass is not defined): 'remote_user' is undefined\n\nThe error appears to be in '/usr/src/ansible/playbooks/setup-gitlab-runner.yml': line 25, column 7, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n        var: ansible_remote_user\n    - name: Fail if no become_pass is set\n      ^ here\n"}
ansible
2 Answers

Because this information is not available at a playbook level, the flag --ask-become-pass being just an indicator for the Python script to prompt the user for the password, what you could do instead is to run a dummy task, with an escalation, rescue it, and prompt the user for the right course of action.

For example, the block:

- block:
  - name: Test privilege escalation
    shell: echo
    changed_when: no
    become: yes

  rescue:
    - fail:
        msg: |-
          User `{{ _user }}` is not sudoer and no escalation was provided.
          Try using '--ask-become-pass' when executing this playbook.
      vars:
        _user: "{{ lookup('env','USER') }}"

Will fail on my user demo, with the message:

TASK [Test privilege escalation] *********************************************
fatal: [localhost]: FAILED! => changed=false 
  module_stderr: |-
    sudo: a password is required
  module_stdout: ''
  msg: |-
    MODULE FAILURE
    See stdout/stderr for the exact error
  rc: 1

TASK [fail] ******************************************************************
fatal: [localhost]: FAILED! => changed=false 
  msg: |-
    User `demo` is not sudoer and no escalation was provided.
    Try using '--ask-become-pass' when executing this playbook.

Otherwise, it will go through with:

TASK [Test privilege escalation] *********************************************
ok: [localhost]
user_21235300

Considering the documentation for become you could hardcode required credentials into the playbook via Ansible Vault. If one were to not posess the correct vault file containing the encoded credentials, playbook execution would fail.

user_192381310
Related