diff --git a/changelogs/fragments/187-fix-synchronize-become-user.yml b/changelogs/fragments/187-fix-synchronize-become-user.yml new file mode 100644 index 0000000000..77d72e016e --- /dev/null +++ b/changelogs/fragments/187-fix-synchronize-become-user.yml @@ -0,0 +1,4 @@ +--- +bugfixes: + - synchronize - use become_user when invoking rsync on remote with sudo + (https://github.com/ansible-collections/ansible.posix/issues/186). diff --git a/plugins/action/synchronize.py b/plugins/action/synchronize.py index ec71fe0ec9..2f0a6e0fad 100644 --- a/plugins/action/synchronize.py +++ b/plugins/action/synchronize.py @@ -367,7 +367,10 @@ def run(self, tmp=None, task_vars=None): # If no rsync_path is set, become was originally set, and dest is # remote then add privilege escalation here. if self._play_context.become_method == 'sudo': - rsync_path = 'sudo rsync' + if self._play_context.become_user: + rsync_path = 'sudo -u %s rsync' % self._play_context.become_user + else: + rsync_path = 'sudo rsync' # TODO: have to add in the rest of the become methods here # We cannot use privilege escalation on the machine running the diff --git a/tests/unit/plugins/action/fixtures/synchronize/basic_become/meta.yaml b/tests/unit/plugins/action/fixtures/synchronize/basic_become/meta.yaml index 1ba3b4ab9b..8435735b67 100644 --- a/tests/unit/plugins/action/fixtures/synchronize/basic_become/meta.yaml +++ b/tests/unit/plugins/action/fixtures/synchronize/basic_become/meta.yaml @@ -25,7 +25,8 @@ asserts: - "self.execute_called" - "self.final_module_args['_local_rsync_path'] == 'rsync'" # this is a crucial aspect of this scenario ... - - "self.final_module_args['rsync_path'] == 'sudo rsync'" + # note: become_user None -> root + - "self.final_module_args['rsync_path'] == 'sudo -u root rsync'" - "self.final_module_args['src'] == '/tmp/deleteme'" - "self.final_module_args['dest'] == 'root@el6host:/tmp/deleteme'" - "self.task.become == True" diff --git a/tests/unit/plugins/action/fixtures/synchronize/basic_become_cli/meta.yaml b/tests/unit/plugins/action/fixtures/synchronize/basic_become_cli/meta.yaml index 5e558012a5..294bfdeb1b 100644 --- a/tests/unit/plugins/action/fixtures/synchronize/basic_become_cli/meta.yaml +++ b/tests/unit/plugins/action/fixtures/synchronize/basic_become_cli/meta.yaml @@ -25,7 +25,8 @@ asserts: - "self.execute_called" - "self.final_module_args['_local_rsync_path'] == 'rsync'" # this is a crucial aspect of this scenario ... - - "self.final_module_args['rsync_path'] == 'sudo rsync'" + # note: become_user None -> root + - "self.final_module_args['rsync_path'] == 'sudo -u root rsync'" - "self.final_module_args['src'] == '/tmp/deleteme'" - "self.final_module_args['dest'] == 'root@el6host:/tmp/deleteme'" - "self.task.become == None"