unattended_upgrades: Add explicit become directives

Add explicit `become: true` to all tasks and handlers requiring root
privileges in the unattended_upgrades role. This ensures privilege
escalation is explicit and consistent with other roles in the
collection, resolving permission errors when the role is used without
playbook-level become inheritance.

Fixes #510

Signed-off-by: Norman Ziegner <n.ziegner@hzdr.de>

Author: Normo

roles/unattended_upgrades/handlers/main.yml

@@ -8,13 +8,15 @@
 # handlers file for unattended-upgrades
 
 - name: 'Restart apt-daily timer'
+  become: true
   ansible.builtin.systemd:
     daemon_reload: true
     name: 'apt-daily.timer'
     state: 'restarted'
     enabled: true
 
 - name: 'Restart apt-daily-upgrade timer'
+  become: true
   ansible.builtin.systemd:
     daemon_reload: true
     name: 'apt-daily-upgrade.timer'

roles/unattended_upgrades/tasks/reboot.yml

@@ -8,6 +8,7 @@
 # Ignored, since newer distros don't need this package
 # https://github.com/jnv/ansible-role-unattended-upgrades/issues/6
 - name: "Install update-notifier-common"
+  become: true
   ansible.builtin.apt:
     name: "update-notifier-common"
     state: "present"

roles/unattended_upgrades/tasks/systemd_timers.yml

@@ -6,20 +6,23 @@
 ---
 
 - name: 'Test apt-daily timer expression'
+  become: true
   ansible.builtin.command:
     cmd: 'systemd-analyze calendar "{{ unattended_apt_daily_oncalendar }}"'
   register: '__apt_daily'
   changed_when: '__apt_daily.rc != 0'
   check_mode: false
 
 - name: 'Test apt-daily-upgrade timer expression'
+  become: true
   ansible.builtin.command:
     cmd: 'systemd-analyze calendar "{{ unattended_apt_daily_upgrade_oncalendar }}"'
   register: '__apt_daily_upgrade'
   changed_when: '__apt_daily_upgrade.rc != 0'
   check_mode: false
 
 - name: 'Ensure directory apt-daily.timer.d exists'
+  become: true
   ansible.builtin.file:
     path: '/etc/systemd/system/apt-daily.timer.d'
     mode: '0755'
@@ -28,6 +31,7 @@
     group: 'root'
 
 - name: 'Ensure directory apt-daily-upgrade.timer.d exists'
+  become: true
   ansible.builtin.file:
     path: '/etc/systemd/system/apt-daily-upgrade.timer.d'
     mode: '0755'
@@ -36,6 +40,7 @@
     group: 'root'
 
 - name: 'Deploy apt-daily timer'
+  become: true
   ansible.builtin.template:
     src: 'apt_daily_override.conf.j2'
     dest: '/etc/systemd/system/apt-daily.timer.d/schedule_override.conf'
@@ -48,6 +53,7 @@
     - 'Restart apt-daily timer'
 
 - name: 'Deploy apt-daily-upgrade timer'
+  become: true
   ansible.builtin.template:
     src: 'apt_daily_upgrade_override.conf.j2'
     dest: '/etc/systemd/system/apt-daily-upgrade.timer.d/schedule_override.conf'

roles/unattended_upgrades/tasks/systemd_timers_remove.yml

@@ -6,13 +6,15 @@
 ---
 
 - name: 'Remove apt-daily timer override'
+  become: true
   ansible.builtin.file:
     path: '/etc/systemd/system/apt-daily.timer.d/schedule_override.conf'
     state: 'absent'
   notify:
     - 'Restart apt-daily timer'
 
 - name: 'Remove apt-daily-upgrade timer override'
+  become: true
   ansible.builtin.file:
     path: '/etc/systemd/system/apt-daily-upgrade.timer.d/schedule_override.conf'
     state: 'absent'

roles/unattended_upgrades/tasks/unattended-upgrades.yml

@@ -16,6 +16,7 @@
         - 'vars'
 
 - name: "Install powermgmt-base"
+  become: true
   ansible.builtin.apt:
     name: "powermgmt-base"
     state: "present"
@@ -25,6 +26,7 @@
   when: "unattended_only_on_ac_power"
 
 - name: "Install unattended-upgrades"
+  become: true
   ansible.builtin.apt:
     name: "unattended-upgrades"
     state: "present"
@@ -37,6 +39,7 @@
   when: "unattended_automatic_reboot | bool"
 
 - name: "Create Apt auto-upgrades & unattended-upgrades configuration"
+  become: true
   ansible.builtin.template:
     src: "unattended-upgrades.j2"
     dest: "/etc/apt/apt.conf.d/90-ansible-unattended-upgrades"