test_become_unix.yml (5813B)
1 # Adapted from Ansible's test/integration/targets/connection_local/test_become_password_handling.yml 2 3 - hosts: aoh 4 tasks: 5 - name: skip this test for Windows hosts / non-root users 6 block: 7 - debug: 8 msg: Skipping sudo test for Windows host / non-root user. 9 - meta: end_play 10 when: ansible_facts.user_id != 'root' 11 12 - name: attempt root-to-root sudo become (no-op, should succeed) 13 vars: 14 ansible_become: yes 15 ansible_become_user: root 16 ansible_become_method: sudo 17 raw: whoami 18 register: root_noop_sudo 19 20 - assert: 21 that: 22 - root_noop_sudo.stdout is contains "root" 23 24 - name: create an unprivileged become user pair 25 include_role: 26 name: setup_become_user_pair 27 public: true 28 29 - name: deploy sudo shim 30 copy: 31 src: sudoshim.sh 32 dest: /tmp/sudoshim.sh 33 mode: u+x 34 35 - set_fact: 36 default_sudo_flags: "{{ lookup('config', 'become_flags', plugin_type='become', plugin_name='sudo') }}" 37 38 - name: apply shared become vars to all tasks that use the sudo test shim 39 vars: 40 ansible_become: yes 41 ansible_become_method: sudo 42 ansible_become_user: '{{ target_user_name }}' 43 ansible_become_password: '{{ target_user_password }}' 44 ansible_become_exe: /tmp/sudoshim.sh 45 intermediate: "{{ ((' --intermediate-user ' + intermediate_user_name) if intermediate_user_name is defined else '') }}" 46 block: 47 - name: verify stdout/stderr noise is present 48 raw: echo $(whoami) ran 49 vars: 50 ansible_become_flags: "{{ default_sudo_flags ~ intermediate ~ ' --inject-stdout-noise --inject-stderr-noise' }}" 51 ansible_become_password: "{{ intermediate_user_password }}" 52 register: preamble_visible 53 54 - assert: 55 that: 56 - preamble_visible.stdout is contains(target_user_name ~ " ran") 57 - preamble_visible.stdout is contains "stdout noise" 58 - preamble_visible.stderr is contains "stderr noise" 59 60 - name: verify sudo succeeds with a password 61 raw: echo $(whoami) ran 62 vars: 63 ansible_become_flags: "{{ default_sudo_flags ~ intermediate }}" 64 ansible_become_password: "{{ intermediate_user_password }}" 65 register: success 66 67 - assert: 68 that: 69 - success.stdout is contains(target_user_name ~ " ran") 70 - success.stderr is search 'sudo via ansible.*password\:' 71 72 - name: verify early-closed stderr still sees success 73 # this test triggers early EOF (which unregisters the associated selector) on most OSs, but not on Ubuntu 24.04 74 vars: 75 ansible_become_flags: --close-stderr --sleep-before-sudo --pretend-to-be-sudo 76 raw: echo ran_ok 77 register: stderr_closed 78 79 - assert: 80 that: 81 - stderr_closed.stderr is contains "some injected stderr, EOF now" 82 - stderr_closed.stdout is contains "ran_ok" 83 84 - name: verify timeout handling by setting a sudo prompt that won't trigger password send 85 vars: 86 ansible_become_flags: "{{ default_sudo_flags ~ intermediate }} --bogus-prompt" 87 raw: exit 99 88 ignore_errors: true # TODO: Make aoh return AnsibleConnectionFailure on become timeout? 89 register: prompt_timeout 90 91 - assert: 92 that: 93 # - prompt_timeout is unreachable # AOH 94 - prompt_timeout.msg is contains "Timed out waiting for become success or become password prompt" 95 - prompt_timeout.msg is contains "BOGUSPROMPT" 96 - prompt_timeout.rc is not defined 97 98 - name: verify handling of premature exit/stream closure 99 vars: 100 ansible_become_exe: /bogus 101 raw: exit 99 102 ignore_errors: true 103 register: early_close 104 105 - assert: 106 that: 107 - early_close is failed 108 - early_close.msg is contains "Premature end of stream" 109 110 - name: verify lack of required password fails as expected 111 raw: exit 99 112 vars: 113 ansible_become_flags: "{{ default_sudo_flags ~ intermediate }}" 114 ansible_become_password: ~ 115 ignore_errors: true 116 register: missing_required_password 117 118 - assert: 119 that: 120 - missing_required_password is failed 121 - missing_required_password.msg is contains "password is required" or missing_required_password.msg is contains "interactive authentication is required" 122 123 - name: verify duplicate password prompts are handled (due to incorrect password) 124 raw: echo hi mom 125 vars: 126 ansible_become_flags: "{{ default_sudo_flags ~ intermediate }}" 127 ansible_become_password: not_the_correct_password 128 ignore_errors: yes 129 register: incorrect_password 130 131 - assert: 132 that: 133 - incorrect_password is failed 134 - incorrect_password.msg is contains "Duplicate become password prompt encountered" 135 136 - name: no error, but no become success message 137 vars: 138 ansible_become_flags: --pretend-to-be-broken-sudo # handle password prompt, but return no output 139 raw: exit 99 # should never actually run anyway 140 ignore_errors: true 141 register: no_become_success 142 143 - assert: 144 that: 145 - no_become_success is failed 146 - no_become_success.msg is contains "Premature end of stream waiting for become success" 147 148 - name: test broken passwordless sudo 149 raw: echo hi mom 150 vars: 151 ansible_become_flags: --pretend-to-be-broken-passwordless-sudo 152 ignore_errors: yes 153 register: broken_passwordless_sudo 154 155 - assert: 156 that: 157 - broken_passwordless_sudo is failed 158 - broken_passwordless_sudo.msg is contains "not a module response"