Difference between become and become_user in Ansible

Question

Recently I started digging into Ansible and writing my own playbooks. However, I have a troubles with understanding difference between become and become_user. As I understand it become_user is something similar to su <username>, and become means something like sudo su or "perform all commands as a sudo user". But sometimes these two directives are mixed.

Could you explain the correct meaning of them?

udondan · Accepted Answer · 2023-03-28T09:43:14.860

become_user defines the user which is being used for privilege escalation.

become simply is a flag to either activate or deactivate the same.

Here are three examples which should make it clear:

This task will be executed as root, because root is the default user for privilege escalation:
```
 - do: something
   become: true
```
This task will be executed as user someone, because the user is explicitly set:
```
 - do: something
   become: true
   become_user: someone
```
This task will not do anything with become_user, because become is not set and defaults to false/no:
```
 - do: something
   become_user: someone
```

...unless become was set to true on a higher level, e.g. a block, the playbook, group or host-vars etc.

Here is an example with a block:

    - become: true
      block:
        - do: something
          become_user: someone
        - do: something

The first 1st is ran as user someone, the 2nd as root.

As I understand it become_user is something similar to su , and become means something like sudo su or "perform all commands as a sudo user".

The default become_method is sudo, so sudo do something or sudo -u <become_user> do something

_{^{Fineprint: Of course "do: something" is pseudocode. Put your actual Ansible module there.}}

So if I want to enable privilege escalation for tasks in playbook I can set become: True once before I define tasks, and afterwards just use become_user whenever I want, right? — Andrii Rusanov, Jul 10 '16 at 10:21
That depends on what you mean with "once before". If you set `become` on a single task, it only is active for that single task. If you want to set `become` for multipel tasks you need to set it on a higher level. You could use [blocks](http://docs.ansible.com/ansible/playbooks_blocks.html) or [includes](http://docs.ansible.com/ansible/playbooks_roles.html#task-include-files-and-encouraging-reuse) for this or set in on your role. — udondan, Jul 10 '16 at 10:40
@udondan i am getting the error while using your point no 2. Can you please help me? — Tech Learner, Jun 30 '18 at 16:49

AATHITH RAJENDRAN · Answer 2 · 2020-04-25T04:04:24.667

13

become: yes = sudo
become_user: user_name = sudo -u user_name
become: yes
become_user: root is equivalent of become: yes

this link is explaining the difference clearly.

edited Apr 25 '20 at 04:04

answered Mar 06 '20 at 13:50

AATHITH RAJENDRAN

4,689
8
34
58

1

This answer is potentially misleading. If become=yes, then become_user can be used to override the default user. But used on its own, become_user has no effect. – Ben Aveling Feb 04 '22 at 02:07
Can you explain further? @BenAveling it's a little confusing on what you are trying to say. – AATHITH RAJENDRAN Feb 04 '22 at 05:47
Unless "become: yes" is set, setting "become_user" does nothing. – Ben Aveling Feb 07 '22 at 08:29
Yes. How is my answer misleading? – AATHITH RAJENDRAN Feb 07 '22 at 11:30
because you've separated become:yes from become_user: making it look like you're saying "become_user: root is equivalent of become: yes" – Ben Aveling Feb 07 '22 at 12:25
1

The link mentioned in the answer should explain everything, as it is very clear. I understood the difference by reading the link. – Aldy J May 26 '22 at 08:02

score 0 · Answer 3 · answered Jul 06 '20 at 17:27

If I need to run a batch of task with sudo, I often use an include_task statement. It also helps a lot to keep a large playbook split up in parts. For example

 - name: prepare task x
   include_tasks: x-preparation.yml
   when: condition is true
   args:
     apply:
       become: yes

This is also a handy approach when using tags:

  - name: execute tasks x
     include_tasks: x-execution.yml
     args:
       apply:
         tags: exec
     tags:
     - exec

Important is that you need to put a tag on the include_tasks statement as well Hope this is helpful for anyone

score 0 · Answer 4 · answered Jul 10 '22 at 11:48

0

Become yes will make run the code block as root user by default. If you add become_user: "user1" along with become: yes then current code block will run as user1.

answered Jul 10 '22 at 11:48

Balram Parmar

1
1

Difference between become and become_user in Ansible

4 Answers4

Linked