Repository: ansible/ansible

Issue:
generic "SUDO password:" prompt even for non sudo become Privilege Escalation
##### ISSUE TYPE
Documentation Report
##### COMPONENT NAME
lib/ansible/cli/__init__.py

##### ANSIBLE VERSION
```
ansible 2.4.1.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/home/centos/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, Aug  4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]
```
##### CONFIGURATION
```
$ ansible-config dump --only-changed
DEFAULT_HOST_LIST(/etc/ansible/ansible.cfg) = [u'/etc/ansible/hosts']
DEFAULT_ROLES_PATH(/etc/ansible/ansible.cfg) = [u'/etc/ansible/roles', u'/usr/share/ansible/roles']
```
##### OS / ENVIRONMENT
```
LSB Version:	:core-4.1-amd64:core-4.1-noarch
Distributor ID:	CentOS
Description:	CentOS Linux release 7.4.1708 (Core) 
Release:	7.4.1708
Codename:	Core
```
##### SUMMARY
Confusing prompt:
Console asks for "SUDO password:" while I am using: "become_method: su"

Note: not a real bug, but is just the for a novice, since Ansible Documentation is so good, this prompt sounds like a user mistake or something that is not working.  I encounter this issue while starting, but I imagine that if somebody else gives me an already written playbook I wont be able to make it run since, of course, the "sudo" password of an unprivileged user is not the "su" pass to become root (the default become user)

##### STEPS TO REPRODUCE

```
ansible-playbook test.yml  --ask-become-pass
```
with

```yaml
---
- hosts: all
  remote_user: developer
  tasks:
  - name: testing su
    command: whoami
    become: true
    become_user: root
    become_method: su
```
##### EXPECTED RESULTS
I would expect:
```
"SU password:" 
(or "Privilege Escalation password:")
```
##### ACTUAL RESULTS
I get
```
"SUDO password:" 
```
but, of course, everything works perfect if I type in the "su" password (and not the sudo password).

!component core


Discussion:
Files identified in the description:
None

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
Looks like the prompting for '--ask-become-pass' doesn't know to ask for 'su' since it is not processing the host/task thats sets become_method yet.

`ansible-playbook -vvv --ask-become-pass --become-method su test.yml` seems to do the right thing, but it is wrong and confusing for the case described.

Not sure if we have any info at prompt time to infer the right become method prompt. If a play had multiple tasks, each with different become_user/become_method values, the cli prompt is going to be at least partially wrong.

Long term, correct fix is probably either:
- prompting for become creds as they are needed (and after we know the become_user/become_method)
- wait until tasks have been parsed and try to ask before they are needed though that will never cover all cases since the become_user/become_method may be variables...
Files identified in the description:
* [lib/ansible/cli/__init__.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/cli/__init__.py)
* [lib/ansible/cli/adhoc.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/cli/adhoc.py)
* [lib/ansible/cli/config.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/cli/config.py)
* [lib/ansible/cli/console.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/cli/console.py)
* [lib/ansible/cli/doc.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/cli/doc.py)
* [lib/ansible/cli/galaxy.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/cli/galaxy.py)
* [lib/ansible/cli/inventory.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/cli/inventory.py)
* [lib/ansible/cli/playbook.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/cli/playbook.py)
* [lib/ansible/cli/pull.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/cli/pull.py)
* [lib/ansible/cli/vault.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/cli/vault.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->

Resolving patch:
diff --git a/lib/ansible/cli/__init__.py b/lib/ansible/cli/__init__.py
--- a/lib/ansible/cli/__init__.py
+++ b/lib/ansible/cli/__init__.py
@@ -323,11 +323,11 @@ def ask_passwords(self):
         try:
             if op.ask_pass:
                 sshpass = getpass.getpass(prompt="SSH password: ")
-                become_prompt = "%s password[defaults to SSH password]: " % op.become_method.upper()
+                become_prompt = "BECOME password[defaults to SSH password]: "
                 if sshpass:
                     sshpass = to_bytes(sshpass, errors='strict', nonstring='simplerepr')
             else:
-                become_prompt = "%s password: " % op.become_method.upper()
+                become_prompt = "BECOME password: "
 
             if op.become_ask_pass:
                 becomepass = getpass.getpass(prompt=become_prompt)


Test patch: