Making Ansible, Doas and OpenBSD play nicely
A little while ago, OpenBSD replaced sudo in the base system with doas. This transition follows a typical path in the OpenBSD community where a large, difficult to audit daemon or key application is replaced by an auditable and securable alternate implementation. At the same time, features are pruned if they add significant complexity. I don’t need all the features of sudo and I like the simplicity and security of doas so I wanted to switch. I use Ansible to provision and manage my small collection of servers and when version 2.0 added support for privilege escalation via doas (via the become keyword) I started to make my switch. The main use-case in my Ansible playbooks is where I run as root and become my non-admin user so that permissions are set correctly by default, and in this case doas behaves differently…
# /usr/bin/env | grep -E '^(HOME|USER)=' HOME=/root USER=root # sudo -u esteele /usr/bin/env | grep -E '^(HOME|USER)=' USER=esteele HOME=/home/esteele # doas -u esteele /usr/bin/env | grep -E '^(HOME|USER)=' HOME=/root USER=root
The key difference is which environment variables are propagated from the original session. I find doas to be a little unintuitive in this respect, particularly the inability in the new session to write to the directory specified by $HOME and this behaviour causes problems with the Ansible git and the pip tasks. The git task expects $USER to correspond to the effective user id and the pip task expects $HOME to be the home directory of the effective user id. The unexpected doas environment meant the tasks were trying to write files, as my non-admin user, under /root which was unsurprisingly unsuccessful. Fortunately Ansible has a way to specify environment variables for a task and even though it’d be preferable for the become mechanism to take care of this, it’s an effective workaround (albeit a slightly dirty one).
The example below, from my web host playbook, ties the environment specification and the doas become in a block
# doas preserves USER and HOME, which is different to sudo, however by # specifying them as environment variables we can proceed. # USER is required for git, and HOME is required for pip - block: - name: Checkout wordspeak repo git: repo=ssh://git@github.com/edwinsteele/wordspeak.org.git dest=/home/esteele/Code/wordspeak.org - name: Setup nikola virtualenv pip: requirements=/home/esteele/Code/wordspeak.org/requirements.txt virtualenv_command=/usr/local/bin/virtualenv virtualenv=/home/esteele/.virtualenvs/wordspeak_n7 become: True become_method: doas become_user: esteele environment: USER: esteele HOME: /home/esteele
And having tied this together, I can remove the sudo package!
- name: Remove sudo openbsd_pkg: name=sudo-- state=absent