validate sudo become plugin against sudo-rs

[sivel]

Summary

Ubuntu 25.10 will drop sudo.ws in favor of sudo-rs. sudo-rs does not aim to be a 100% compatible replacement, and only aims to cover some of the common behaviors in sudo.

Until 0.2.5 sudo-rs did not support the -p/--prompt arg that we use for matching the prompt. Ubuntu 25.10 appears to be including 0.2.8. sudo implemented this by capturing the pam password prompt, and rewriting it, which the sudo-rs maintainers did not implement.

Instead sudo-rs seems to print an additional string before delegating to pam, which seems to create a prompt like the following that our sudo become plugin does not support:

[sudo: [sudo via ansible, key=spnnznrgscgdxdontsjkwrlyghiiglxk] password:] Password:

There may be other incompatibilities, but since Ubuntu 25.10 switches to sudo-rs to provide sudo, we should ensure compatibility.

Issue Type

Bug Report

Component Name

lib/ansible/plugins/become/sudo.py

Ansible Version

$ ansible --version

Configuration

# if using a version older than ansible-core 2.12 you should omit the '-t all'
$ ansible-config dump --only-changed -t all

OS / Environment

Ubuntu 25.05

Steps to Reproduce

Expected Results

sudo become plugin to work

Actual Results

Doesn't work?

Code of Conduct

• I agree to follow the Ansible Code of Conduct

[ansibot]

Files identified in the description:

• lib/ansible/plugins/become/sudo.py

If these files are incorrect, please update the component name section of the description or use the component bot command.

[sivel]

Since prior Ubuntu versions that also include sudo-rs do not ship our minimum need of 0.2.5, we'll want to add a non-LTS Ubuntu (25.10) to CI, likely being replaced as soon as we get an LTS in the future. We've decided not to use the github release binaries for x86 for sudo-rs.

We should then aim to test both sudo-rs and sudo.ws on distros supporting sudo-rs. It seems that the sudo package "Recommends" sudo-rs, so our apt module would not install both when installing sudo.

[makigumo]

What about changing this part:

ansible/lib/ansible/plugins/become/__init__.py

Lines 108 to 113 in 06456c6

	def check_password_prompt(self, b_output):
	""" checks if the expected password prompt exists in b_output """
	if self.prompt:
	b_prompt = to_bytes(self.prompt).strip()
	return any(l.strip().startswith(b_prompt) for l in b_output.splitlines())
	return False

to something like this

 def check_password_prompt(self, b_output): 
     """ checks if the expected password prompt exists in b_output """ 
     if self.prompt: 
         b_prompt = to_bytes(self.prompt).strip() 
         return any(b_prompt in l.strip() for l in b_output.splitlines()) 
     return False 

So instead of checking if the prompt line matches at the beginning, we check for a match inside.
This should cover the old behavior and the sudo-rs quirk.

[bcoca]

that won't work as some systems 'echo' the string, which is why we had to match from the start, maybe we just need to add an option for now sudo_rs_compatibility that changes the match this way, but warns about false matches.

[makigumo]

Thanks for the pointer.

What about checking for both cases, with e.g. a function override in sudo.py like below.
In my mind, an extra option introduces unnecessary complexity. Maybe there is a way to check the sudo type used (sudo --version | head -n1 | grep sudo-rs), so the cases could by handled conditionally.

    def check_password_prompt(self, b_output):
        """ checks if the expected password prompt exists in b_output with sudo-rs quirk"""
        if self.prompt:
            b_prompt = to_bytes(self.prompt).strip()
            b_prompt_sudo_rs = to_bytes(f"[sudo: {self.prompt}] Password:").strip()
         
            for l in b_output.splitlines():
              _l = l.strip()            
              if _l.startswith(b_prompt) or _l.startswith(b_prompt_sudo_rs):
                  return True
        return False

[shuhaowu]

Ubuntu 25.10 is upon us. The current workaround I found is to add the user to nopasswd in sudoers:

<username> ALL=(ALL) NOPASSWD:ALL

[zigarn]

Other workaround: still use sudo.ws (https://github.com/trifectatechfoundation/sudo-rs?tab=readme-ov-file#ubuntu-2510-questing-quokka)

sudo echo update-alternatives --set sudo $(update-alternatives --list sudo | grep sudo.ws)

[konstruktoid]

Another workaround:

    - name: Gather the package facts
      ansible.builtin.package_facts:
        manager: auto

    - name: Become to show id
      ansible.builtin.command:
        cmd: whoami
      become: true
      become_exe: "{{ 'sudo.ws' if ansible_facts.packages['sudo-rs'] is defined else 'sudo' }}"
      changed_when: false
      register: whoami_result

or just export ANSIBLE_BECOME_EXE=sudo.ws

[brlin-tw]

For the record, here's the corresponding bug report on Launchpad: Bug #2122414 “Ansible times out after BECOME password request” : Bugs : rust-sudo-rs package : Ubuntu

[DimanNe]

+1 for the issue. My ansible now hangs & fails with:

[ERROR]: Task failed: Timed out waiting for become success.

sudo-rs 0.2.8 on Ubuntu 25.10

(sudo.ws is not an option, because it is written in C, which is not safe)

---

Never mind, I mixed it with this bug: #86149