Ansible script routed to int_root_priv_ps instead of assigned custom sandbox

Products

• Data Center Security Server Advanced

Issue/Introduction

The customer created predefined application rule for Ansible automation software deployment solution on Linux and reported that executed scripts were routed to int_rootpriv_ps sandbox and not Ansible designated sandbox. 

Environment

RHEL 7

DCS 6.10.1

Cause

The current behavior is by design.

The ansible is agent-less deployment solution and it connects through ssh with a service account and then immediately switches the username to root and executes all the scripts under this new username. 

Resolution

The processes started by the root user are routed by default to Root Program Options sandbox int_rootpriv_ps.

To retain ansible scripts execution in the ansible sandbox additional rule needs to be created under ansible sandbox under General Settings -->Specify Interactive Programs with Custom Privileges that will contains program path for the scripts executed by Ansible, otherwise they will be assigned to the default int_rootpriv_ps because the initial ssh session was started by ansible application with a different username.