"Ensure the sudoers file is valid and up to date (specs all in one)" fails when using become about ansible-sudoers HOT 6 CLOSED

@jph Does your user have sudo access to visudo in your sudoers config?

from ansible-sudoers.

I am having a similar issue. I use a playbook in which I use become_method=su. I use a -K to prompt for the su password. It always fails at this task: Ensure all authorized separate sudoer specs are properly configured. The user at this point should be root. I am having a hard time figuring out why root would not be able to validate the temp file.

from ansible-sudoers.

Just ran again with ANSIBLE_KEEP_REMOTE_FILES=1. The temp file looks good and has the correct data. I walk also able to manually validate the file.

visudo -cf /home/[email protected]/.ansible/tmp/ansible-tmp-1554835420.25-38260832755142/source
/home/[email protected]/.ansible/tmp/ansible-tmp-1554835420.25-38260832755142/source: parsed OK

from ansible-sudoers.

I think I understand what is happening. The template file is created with root:root 440 permissions. I think the validate is being run as the user running ansible and not root. I would think that would be "Permission denied", but I need to examine this further. going to change the mode to 444 for the template file.

Did not work. The user can read the file now. But still [Errno 2] No such file or directory. Maybe the module or something with popen.subprocess.

from ansible-sudoers.

FWIW, if you comment out the validate options it works. Something with the validate option and become are not cooperating. It's not the solution, but at least a starting point.

from ansible-sudoers.

Resolved. Change the validate to use absolute path.

validate: '/usr/sbin/visudo -cf %s'

This should work for EL6 and EL7 variants.

from ansible-sudoers.