title: Restrict Ansible script module using sudoers on the remote node
body: <p>I have a playbook that performs some prechecks on the database as the Oracle user. The remote node is an AIX server and so I created a shell script that is ran via the playbook.</p>
  
  <pre><code>---
  - hosts: db
    var_files:
      - ansible_var.yml
  
    tasks:
      - name: "DB Checks"
      become: True
      become_user: oracle
      script: "{ db_prechk }"
  </code></pre>
  
  <p>On the AIX server, I added the below entry to the sudoers file</p>
  
  <pre><code> ansible ALL=(oracle) NOPASSWD: /tmp/ansible-tmp-*/db_prechecks.sh
  </code></pre>
  
  <p>But the playbook fails with the error that it's waiting for the privilege escalation prompt.</p>
  
  <p>This runs fine if it is ran as root. However we do not want passwordless root between the Ansible controller and the remote nodes. So we created ansible user on the controller and remote nodes and exchanged the SSH keys.</p>
  
  <p>This also runs if the sudoers entry is just</p>
  
  <pre><code>ansible ALL=(oracle) NOPASSWD: ALL
  </code></pre>
  
  <p>We do not want to provide full access to the <code>oracle</code> userid via the <code>ansible</code> user id too. </p>
  
  <p>I ran the playbook in the verbose mode and can see that Ansible is copying the script to the <code>remote_tmp</code> dir and is executing it as the <code>oracle</code> userid. In that case the sudoers line should've allowed it to run?</p>