docs(ansible): document Ubuntu sudo-rs become workaround by thiras · Pull Request #17 · decdn/devops

thiras · 2026-07-11T15:32:16Z

What

Documents a workaround for Ubuntu 25.10+ / 26.04 hosts, which ship sudo-rs as the default /usr/bin/sudo.

Ansible's sudo become plugin passes a custom -p prompt sentinel and waits for it before sending the become password; sudo-rs does not honor that custom -p, so --ask-become-pass / -K hangs with "Timeout waiting for privilege escalation prompt." Classic sudo is still installed at /usr/bin/sudo.ws and honors the prompt Ansible expects.

Changes

ansible/inventory/hosts.yml.example — explanatory comment block + a commented, per-host # ansible_become_exe: /usr/bin/sudo.ws opt-in line under each host (decdn-node-1, anvil-vps).
ansible/README.md — a short Ubuntu sudo-rs note under Requirements.

Why opt-in / per-host

/usr/bin/sudo.ws exists only on Ubuntu 25.10+/26.04. On Debian bookworm / Ubuntu noble the path is absent, so a repo-wide default would break every existing target. Keeping it commented and per-host means operators uncomment it only on affected hosts (detect via sudo --version reporting sudo-rs and/or /usr/bin/sudo.ws existing). Password sudo is preserved — no NOPASSWD, no host change.

Notes

No secrets, no protocol facts, no exposure-posture change (AGENTS.md hard rules unaffected).
The real inventory/hosts.yml is git-local; only the committed template + README are touched here.

Verification

yaml.safe_load on the template parses (commented lines correctly ignored).
yamllint inventory/hosts.yml.example clean; no line over 120 chars.

🤖 Generated with Claude Code

Ubuntu 25.10+/26.04 ship sudo-rs as the default sudo, which doesn't honor the custom -p become prompt Ansible waits on — so --ask-become-pass hangs with "Timeout waiting for privilege escalation prompt". Add a per-host, commented `ansible_become_exe: /usr/bin/sudo.ws` opt-in (routes become through classic sudo) plus explanatory notes in the inventory template and README. Kept opt-in and commented so the Ubuntu-26-only path never breaks Debian bookworm / Ubuntu noble hosts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-07-11T15:32:24Z

Warning

Review limit reached

@thiras, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 32 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 0fe0c5d8-fd82-4a87-81bb-077a4151e01e

📥 Commits

Reviewing files that changed from the base of the PR and between 1632fdb and 15e7fac.

📒 Files selected for processing (2)

ansible/README.md
ansible/inventory/hosts.yml.example

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist

Code Review

This pull request adds documentation and configuration workarounds for an issue where Ansible's privilege escalation hangs on Ubuntu 25.10+ and 26.04 due to the default use of sudo-rs. The reviewer provided valuable feedback pointing out that the classic sudo binary path is /usr/bin/sudo.classic rather than /usr/bin/sudo.ws, and recommended correcting this path across the README and inventory files, as well as removing the unofficial codename 'Questing' for Ubuntu 25.10.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

gemini-code-assist · 2026-07-11T15:33:32Z

+# Ubuntu sudo-rs workaround: 25.10 (Questing) and 26.04 ship sudo-rs as the default
+# /usr/bin/sudo. Ansible's sudo become plugin passes a custom `-p` prompt sentinel and
+# waits for it before sending the become password; sudo-rs does not honor that custom
+# `-p`, so `--ask-become-pass` / -K hangs with "Timeout waiting for privilege
+# escalation prompt". Classic sudo is still installed at /usr/bin/sudo.ws and honors
+# the -p prompt Ansible expects — point become at it with the per-host
+# `ansible_become_exe` line below. Password sudo is preserved (no NOPASSWD, no host
+# change). Only uncomment on an affected host: `sudo --version` reports "sudo-rs"
+# and/or /usr/bin/sudo.ws exists. Leave it commented on Debian bookworm / Ubuntu
+# noble — that path does not exist there.


The path /usr/bin/sudo.ws does not appear to be a standard path for classic sudo in Ubuntu or Debian. Typically, when sudo-rs is co-installed or default, the classic sudo binary is provided by the sudo-classic package and is located at /usr/bin/sudo.classic. Additionally, the codename for Ubuntu 25.10 has not been officially announced as 'Questing'. It is safer to refer to it simply as '25.10'.

# Ubuntu sudo-rs workaround: 25.10 and 26.04 ship sudo-rs as the default # /usr/bin/sudo. Ansible's sudo become plugin passes a custom `-p` prompt sentinel and # waits for it before sending the become password; sudo-rs does not honor that custom # `-p`, so `--ask-become-pass` / -K hangs with "Timeout waiting for privilege # escalation prompt". Classic sudo is still installed at /usr/bin/sudo.classic and honors # the -p prompt Ansible expects — point become at it with the per-host # `ansible_become_exe` line below. Password sudo is preserved (no NOPASSWD, no host # change). Only uncomment on an affected host: `sudo --version` reports "sudo-rs" # and/or /usr/bin/sudo.classic exists. Leave it commented on Debian bookworm / Ubuntu # noble — that path does not exist there.

gemini-code-assist · 2026-07-11T15:33:32Z

    decdn-node-1:
      ansible_host: REPLACE_WITH_NODE_VPS_IP_OR_DNS
      ansible_user: root
+      # ansible_become_exe: /usr/bin/sudo.ws   # Ubuntu sudo-rs workaround — see note above


Update the commented workaround path to use /usr/bin/sudo.classic instead of /usr/bin/sudo.ws.

# ansible_become_exe: /usr/bin/sudo.classic # Ubuntu sudo-rs workaround — see note above

gemini-code-assist · 2026-07-11T15:33:32Z

    anvil-vps:
      ansible_host: REPLACE_WITH_INTERNAL_VPS_IP_OR_DNS
      ansible_user: root
+      # ansible_become_exe: /usr/bin/sudo.ws   # Ubuntu sudo-rs workaround — see note above


Update the commented workaround path to use /usr/bin/sudo.classic instead of /usr/bin/sudo.ws.

# ansible_become_exe: /usr/bin/sudo.classic # Ubuntu sudo-rs workaround — see note above

gemini-code-assist · 2026-07-11T15:33:32Z

+  - **Ubuntu sudo-rs note:** 25.10+ (and 26.04) ship `sudo-rs` as the default `sudo`,
+    which doesn't honor the custom `-p` become prompt Ansible relies on — so
+    `--ask-become-pass` hangs with "Timeout waiting for privilege escalation prompt". On
+    an affected host uncomment `ansible_become_exe: /usr/bin/sudo.ws` for that host in
+    `hosts.yml` (see the note in `inventory/hosts.yml.example`) to route become through
+    classic sudo.


Update the reference to classic sudo path to /usr/bin/sudo.classic to match the standard path on Ubuntu/Debian systems.

Suggested change

- **Ubuntu sudo-rs note:** 25.10+ (and 26.04) ship `sudo-rs` as the default `sudo`,

which doesn't honor the custom `-p` become prompt Ansible relies on — so

`--ask-become-pass` hangs with "Timeout waiting for privilege escalation prompt". On

an affected host uncomment `ansible_become_exe: /usr/bin/sudo.ws` for that host in

`hosts.yml` (see the note in `inventory/hosts.yml.example`) to route become through

classic sudo.

- **Ubuntu sudo-rs note:** 25.10+ (and 26.04) ship `sudo-rs` as the default `sudo`,

which doesn't honor the custom `-p` become prompt Ansible relies on — so

`--ask-become-pass` hangs with "Timeout waiting for privilege escalation prompt". On

an affected host uncomment `ansible_become_exe: /usr/bin/sudo.classic` for that host in

`hosts.yml` (see the note in `inventory/hosts.yml.example`) to route become through

classic sudo.

Copilot

Pull request overview

Documents an Ansible “become” workaround for Ubuntu hosts where sudo-rs is the default /usr/bin/sudo, causing --ask-become-pass to hang due to prompt handling differences. This fits the repo by improving operator-facing guidance without changing any deployment behavior.

Changes:

Add an Ubuntu sudo-rs workaround note to the Ansible Requirements documentation.
Add a detailed comment block in the inventory template plus per-host, commented ansible_become_exe: /usr/bin/sudo.ws opt-in lines.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
ansible/README.md	Adds a Requirements note describing the Ubuntu `sudo-rs` become prompt issue and the per-host workaround.
ansible/inventory/hosts.yml.example	Documents the workaround in the template and provides commented per-host `ansible_become_exe` lines for opt-in.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+# Ubuntu sudo-rs workaround: 25.10 (Questing) and 26.04 ship sudo-rs as the default
+# /usr/bin/sudo. Ansible's sudo become plugin passes a custom `-p` prompt sentinel and
+# waits for it before sending the become password; sudo-rs does not honor that custom
+# `-p`, so `--ask-become-pass` / -K hangs with "Timeout waiting for privilege
+# escalation prompt". Classic sudo is still installed at /usr/bin/sudo.ws and honors
+# the -p prompt Ansible expects — point become at it with the per-host
+# `ansible_become_exe` line below. Password sudo is preserved (no NOPASSWD, no host


@@ -39,6 +39,12 @@ baseline   host hardening — DevSec os/ssh, nftables default-deny inbound,
 - Control machine: **Ansible ≥ 2.15**, `ansible-lint`, `yamllint` (and Docker + `molecule`
  + `molecule-plugins[docker]` for the anvil molecule scenario).
 - Target: **Debian (bookworm)** host(s) reachable over SSH with a sudo-capable user.


Copilot AI review requested due to automatic review settings July 11, 2026 15:32

Copilot started reviewing on behalf of thiras July 11, 2026 15:32 View session

gemini-code-assist Bot reviewed Jul 11, 2026

View reviewed changes

Copilot AI reviewed Jul 11, 2026

View reviewed changes

thiras merged commit dee47dc into main Jul 11, 2026
9 checks passed

thiras deleted the docs/ubuntu-sudo-rs-become-workaround branch July 11, 2026 15:37

Navigation Menu

docs(ansible): document Ubuntu sudo-rs become workaround - #17

docs(ansible): document Ubuntu sudo-rs become workaround#17
thiras merged 1 commit into
mainfrom
docs/ubuntu-sudo-rs-become-workaround

thiras commented Jul 11, 2026

Uh oh!

coderabbitai Bot commented Jul 11, 2026

Review limit reached

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jul 11, 2026

Uh oh!

gemini-code-assist Bot Jul 11, 2026

Uh oh!

gemini-code-assist Bot Jul 11, 2026

Uh oh!

gemini-code-assist Bot Jul 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

thiras commented Jul 11, 2026

What

Changes

Why opt-in / per-host

Notes

Verification

Uh oh!

coderabbitai Bot commented Jul 11, 2026

Review limit reached

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants