<p dir="auto">Debian systems generally don't install sudo, and none of our production servers have it installed. Instead, when we need to execute commands as another user, we use <code class="notranslate">su username -c</code>.</p>
<p dir="auto">Could Ansible be modified to support different user-switching techniques than sudo? <code class="notranslate">su -c</code> can't be made to accept the same options as sudo, as far as I know. At least trying to set sudo_exe to various invocations of <code class="notranslate">su -c</code> weren't successful for me.</p>
<p dir="auto">The problem showed up when trying to use the postgresql_user module as user 'postgresql' on a Debian machine. If I use <code class="notranslate">sudo_user: postgresql</code> on a machine without sudo, things fail, of course, since the root user (which we normally connect as) isn't allowed to admin the PostgreSQL database.</p>
<p dir="auto">This can be solved in two ways, either by making root a trusted superuser on PostgreSQL by rewriting pg_hba.conf via Ansible or by having a different mechanism to become the user postgres.</p>
<p dir="auto">We would prefer not to install sudo anywhere, since we don't have a need for it and it just adds one more layer and attack vector to the system's security and is yet another component we'd have to manage.</p>
<p dir="auto">file.set_context_if_different() contains this code:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="for i in range(len(context)):
    if context[i] is not None and context[i] != cur_context[i]:"><pre class="notranslate"><code class="notranslate">for i in range(len(context)):
    if context[i] is not None and context[i] != cur_context[i]:
</code></pre></div>
<p dir="auto">On my box <code class="notranslate">context</code> looks like this:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="[None, None, None, u's0']"><pre class="notranslate"><code class="notranslate">[None, None, None, u's0']
</code></pre></div>
<p dir="auto">And <code class="notranslate">cur_context</code> looks like this:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="[u'user_u', u'object_r', u'etc_t']"><pre class="notranslate"><code class="notranslate">[u'user_u', u'object_r', u'etc_t']
</code></pre></div>
<p dir="auto">Point being that <code class="notranslate">cur_context[3]</code> doesn't exist, so it crashes with <code class="notranslate">list index out of range</code>.  I don't know anything about SELinux, so I have no idea what these mean or what the fix is.  Incidentally, this error is <em>not</em> bubbled up to the user, so I just get an 'unreachable' error with a dict that looks like everything is fine.</p>