Install Cask Apps with sudo requirement #73
Comments
|
Hmm, good point. I haven't run into this personally, but can you list a few with this requirement for testing? |
|
One is for example "vmware-fusion". Probably "virtualbox" as well. Can give more examples later if you need. |
|
@mindrunner IMO, the best solution is to ensure that the homebrew user is a member of the I just tested this role using following casks in a vagrant environment:
There were no prompts for the sudo password and each of the tools appear to have been successfully installed. I think the simplest path forward is to just add the user to the |
|
Hi @geerlingguy. Thanks for getting back to me and trying to reproduce. However, I do not really agree with your observations. I don't think that default sudo setup on macOS allows passwordless sudo. The wheel-group-acces-line in sudoers is commented by default. Maybe you changed it locally to have passwordless sudo? On my CI-Buildnodes, which are VMs, I have passwordless sudo and everything works fine. However, on the physical Macs, I cannot go for that option for security reasons. |
|
I stand corrected-- The |
|
@elliotweiser I'm running into this too, did you find anything? |
|
@mindrunner (cc @daften) Sorry for dropping this on the floor. I'm preparing a write-up for this, exploring I've explored both approaches with some success, but so far, each comes with a trade-off. Still looking into it. References: |
|
Sweet! Thanks for the feedback. Anything I can help with? |
|
I have similar issue, see geerlingguy/mac-dev-playbook#53 Actually, just discovered that with homebrew 1.3.5, there is no issue anymore! I can run this role to install java or pdftotext cask, so it seems something has changed in homebrew, not sure in which version though. |
That's not actually true. Make sure your user account doesn't have My issue with the |
|
@JulianArevalo I like the approach you shared above. The trick will be re-running it/updating until all declared casks are installed. This will likely necessitate separating the downloading and the installation into separate steps (see issues I linked for context). To wrap it up, there should be a final invocation of |
|
Regrettably, refreshing the sudo credential cache doesn't seem to work very well when the connection is SSH-based. Without |
|
Hi @elliotweiser |
|
@mindrunner Sorry it's still an issue. I'm gradually regaining my free time, so hopefully I can take another whack at it over the weekend. |
|
Ran into this issue also, and there are many confusing suggestions out there, none of which work, but luckily they did inspire a solution. The solution below works thanks to this 2016 commit that added support for the Assumes use of The general approach:
Sample template - I keep it for example in Sample playbook that installs java using this approach: |
|
How about allow passwordless sudo for the duration of running a block of tasks that install casks like java? |
|
I had success with @g0t4's approach. I was able to wire it up to the role like so (assumes a - name: Install Homebrew packages
block:
- name: allow passwordless sudo
lineinfile:
path: /etc/sudoers
line: '{{ user }} ALL=(ALL) NOPASSWD: ALL'
become: yes
- include_role:
name: geerlingguy.homebrew
always:
- name: disable passwordless sudo
lineinfile:
path: /etc/sudoers
line: '{{ user }} ALL=(ALL) NOPASSWD: ALL'
state: absent
become: yes |
|
Can everyone who still has this issue run a |
|
@danieljaouen You might want to check if your |
|
My user doesn't have password-less sudo and I was correctly prompted for a password when I tried to install some of the given casks. Is it possible that this issue was corrected in one of the later versions of Ansible or Homebrew? |
|
For reference, here is the output from running a And an |
|
What do you mean exactly by "correctly prompted"? Since ansible is used for automatisation, there is no place for prompts imho. The goal here should be, to make it possible to use ansible-become in some way, to elevate ansibles permission as needed without users intervention. |
|
Oh, I see what you mean. I had assumed that the prompt for the password was eaten by Ansible, and that was what you meant when you said "hangs forever". I will have to look into a different solution for this, then. Thanks for the reply. |
|
Yes, you are absolutely right. The main goal however, should be a fully unattended process. :) |
|
@mindrunner You're right. Currently working on this here: ansible/ansible#46471 |
|
Microsoft-teams is one such app, where elevation to sudo is required to install. Sample playbook Resulting output |
|
As the OP stated, using |
|
The upstream fix was purportedly merged and available in Ansible 2.8. If so, then it's time to follow this up. |
|
This is still quite an issue.. Is there a fix on the way? :-) |
Can you give more information about your issue? 2.8 was released a while ago. |
|
Ansible 2.8's been out a while; I don't currently have this issue, so if someone can file a PR with any necessary changes I'd be happy to take a look at some point... |
|
I'm reviewing some of the open PRs today so I'll check that the homebrew module updates in 2.8 change will perma-fix this. |
|
I’m not having problems with the “hanging”. The app works well but i was wondering if it was possible to skip the sudo pass. For instance when I’m trying to install adobe reader through cask it needs my password? |
|
Hey there, I try to Install java through a case and it's hanging for me on the installation process. Any advice for this? |
|
This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution! Please read this blog post to see the reasons why I mark issues as stale. |
|
This issue has been closed due to inactivity. If you feel this is in error, please reopen the issue or file a new issue with the relevant details. |
|
I have same issue, how to resolve? Thanks |
|
Hitting this issue with |
|
The only way I was able to get this to work was to setup the target using visudo and adding my administrative user to be allowed to use This is a bit of a rough guide and actually edits the If you break this file (/etc/sudoers) by messing up the permissions you'll be unable to make any administrative changes and have to boot into recovery mode and reset the file using the OSX Recovery terminal to mount the drive and manually edit the permissions. |
|
This issue is no longer marked for closure. |
|
This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution! Please read this blog post to see the reasons why I mark issues as stale. |
|
Running into this too... |
|
This issue is no longer marked for closure. |
I'm stuck at this too :( It's been a while it seems :/ |
|
I was able to get through this via a slight modification to the role. See below: Changed the task at 111 in main.yml from this: - name: Install configured cask applications.
homebrew_cask:
name: "{{ item.name | default(item) }}"
state: present
install_options: "{{ item.install_options | default('appdir=' + homebrew_cask_appdir) }}"
accept_external_apps: "{{ homebrew_cask_accept_external_apps }}"
loop: "{{ homebrew_cask_apps }}"
notify:
- Clear homebrew cacheto this: - name: Install configured cask applications.
homebrew_cask:
name: "{{ item.name | default(item) }}"
state: present
install_options: "{{ item.install_options | default('appdir=' + homebrew_cask_appdir) }}"
accept_external_apps: "{{ homebrew_cask_accept_external_apps }}"
sudo_password: "{{ homebrew_cask_sudo_password | default(omit) }}"
loop: "{{ homebrew_cask_apps }}"
notify:
- Clear homebrew cache |
|
I am having this same exact issue while using JAMF. No safe solution yet? |
|
Hmm... It seems like it should be simpler to support this, but I can't think of a really clean way to do it besides something like what @theque5t suggests. We could add an optional variable Alternatively you could use |
|
Closing all issues in this repository in preparation for a migration to |
Some Cask Applications require me to authenticate with my sudo password. The ansible provisioning just hangs then forever. Is this known/expected behaviour? Putting the user into sudoers with NOPASSWORD option works around the problem. Can we maybe have an option to pass the sudoers password to homebrew_cask step?
The text was updated successfully, but these errors were encountered: