73

Recently I started digging into Ansible and writing my own playbooks. However, I have a troubles with understanding difference between become and become_user. As I understand it become_user is something similar to su <username>, and become means something like sudo su or "perform all commands as a sudo user". But sometimes these two directives are mixed.

Could you explain the correct meaning of them?

4 Answers 4

144

become_user defines the user which is being used for privilege escalation.

become simply is a flag to either activate or deactivate the same.

Here are three examples which should make it clear:

  1. This task will be executed as root, because root is the default user for privilege escalation:

     - do: something
       become: true
    
  2. This task will be executed as user someone, because the user is explicitly set:

     - do: something
       become: true
       become_user: someone
    
  3. This task will not do anything with become_user, because become is not set and defaults to false/no:

     - do: something
       become_user: someone
    

...unless become was set to true on a higher level, e.g. a block, the playbook, group or host-vars etc.

Here is an example with a block:

    - become: true
      block:
        - do: something
          become_user: someone
        - do: something

The first 1st is ran as user someone, the 2nd as root.

As I understand it become_user is something similar to su , and become means something like sudo su or "perform all commands as a sudo user".

The default become_method is sudo, so sudo do something or sudo -u <become_user> do something

Fineprint: Of course "do: something" is pseudocode. Put your actual Ansible module there.

3
  • So if I want to enable privilege escalation for tasks in playbook I can set become: True once before I define tasks, and afterwards just use become_user whenever I want, right? Jul 10, 2016 at 10:21
  • 4
    That depends on what you mean with "once before". If you set become on a single task, it only is active for that single task. If you want to set become for multipel tasks you need to set it on a higher level. You could use blocks or includes for this or set in on your role.
    – udondan
    Jul 10, 2016 at 10:40
  • @udondan i am getting the error while using your point no 2. Can you please help me? Jun 30, 2018 at 16:49
13
  1. become: yes = sudo
    become_user: user_name = sudo -u user_name
  2. become: yes
    become_user: root is equivalent of become: yes

this link is explaining the difference clearly.

6
  • 1
    This answer is potentially misleading. If become=yes, then become_user can be used to override the default user. But used on its own, become_user has no effect. Feb 4, 2022 at 2:07
  • Can you explain further? @BenAveling it's a little confusing on what you are trying to say. Feb 4, 2022 at 5:47
  • Unless "become: yes" is set, setting "become_user" does nothing. Feb 7, 2022 at 8:29
  • Yes. How is my answer misleading? 🤔 Feb 7, 2022 at 11:30
  • 1
    The link mentioned in the answer should explain everything, as it is very clear. I understood the difference by reading the link.
    – Aldy J
    May 26, 2022 at 8:02
0

If I need to run a batch of task with sudo, I often use an include_task statement. It also helps a lot to keep a large playbook split up in parts. For example

 - name: prepare task x
   include_tasks: x-preparation.yml
   when: condition is true
   args:
     apply:
       become: yes

This is also a handy approach when using tags:

  - name: execute tasks x
     include_tasks: x-execution.yml
     args:
       apply:
         tags: exec
     tags:
     - exec

Important is that you need to put a tag on the include_tasks statement as well Hope this is helpful for anyone

0

Become yes will make run the code block as root user by default. If you add become_user: "user1" along with become: yes then current code block will run as user1.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.