Skip to content

Commit 654f842

Browse files
oraNodpre-commit-ci[bot]ssbarnea
authored
Docs: Add MD for partial-become rule (#2560)
* Docs: Add MD for partial-become rule * chore: auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * add warning Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Sorin Sbarnea <[email protected]>
1 parent dd29bc0 commit 654f842

File tree

1 file changed

+41
-0
lines changed

1 file changed

+41
-0
lines changed
Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# partial-become
2+
3+
This rule checks that privilege escalation is activated when changing users.
4+
5+
To perform an action as a different user with the `become_user` directive, you must set `become: true`.
6+
7+
```{warning}
8+
While Ansible inherits have of `become` and `become_user` from upper levels,
9+
like play level or command line, we do not look at these values. This rule
10+
requires you to be explicit and always define both in the same place, mainly
11+
in order to prevent accidents when some tasks are moved from one location to
12+
another one.
13+
```
14+
15+
## Problematic Code
16+
17+
```yaml
18+
---
19+
- name: Example playbook
20+
hosts: localhost
21+
tasks:
22+
- name: Start the httpd service as the apache user
23+
ansible.builtin.service:
24+
name: httpd
25+
state: started
26+
become_user: apache # <- Does not change the user because "become: true" is not set.
27+
```
28+
29+
## Correct Code
30+
31+
```yaml
32+
- name: Example playbook
33+
hosts: localhost
34+
tasks:
35+
- name: Start the httpd service as the apache user
36+
ansible.builtin.service:
37+
name: httpd
38+
state: started
39+
become: true # <- Activates privilege escalation.
40+
become_user: apache # <- Changes the user with the desired privileges.
41+
```

0 commit comments

Comments
 (0)