title: How can I ensure correct permissions when using Ansible to deploy an application
body: <p>I am having a really hard time understanding how to approach privilege escalation when deploying a python application using Ansible.</p>
  <p>In my current setup:</p>
  <ul>
  <li>The VM is provisioned by our sysadmins</li>
  <li>My user (let's call it &quot;John&quot;) is not root, but can become it via calling sudo.</li>
  </ul>
  <p>No matter what I do via Ansible, it ends being either done via <em>John</em> or <em>root</em> (with <code>become: true</code>).</p>
  <p>I would like to:</p>
  <ol>
  <li>install system packages like python3, pip or supervisord</li>
  <li>setup separate system user</li>
  <li>download the code using the git repository</li>
  <li>create virtualenv</li>
  <li>install requirements in the virtualenv</li>
  <li>setup supervisord</li>
  </ol>
  <p>The list above is really easy when I do it manually - I log into the VM, I use <code>sudo su -</code> to become superuser to handle points 1-2, then <code>su new-system-user</code>, complete points 3-5 etc.</p>
  <p>Some of the tasks are also really easy to do in Ansible when using <code>become: true</code> or using my SSH user, however I get many permission issues when using the newly created system user, and <code>become_user: &quot;{{ system_user }}&quot;</code> in the tasks 3-5 seem not to work as intended.</p>
  <p>I would like to ask you - what is the optimal way to tackle this issue? My only workaround is to do everything in the context of my SSH user, and then copy&amp;chown to the new system-user, but this seems like a hack, and I'm pretty sure I'm missing something when it comes to the correct privilege escalation.</p>