Privilege escalation must be general
You cannot limit privilege escalation permissions to certain commands.
Ansible does not always
use a specific command to do something but runs modules (code) from
a temporary file name which changes every time.  If you have ‘/sbin/service’
or ‘/bin/chmod’ as the allowed commands this will fail with Ansible as those
paths won’t match with the temporary file that Ansible creates to run the
module. If you have security rules that constrain yoursudo/pbrun/doasenvironment
to run specific command paths only, use Ansible from a special account that
does not have this constraint, or use AWX or theRed Hat Ansible Automation Platformto manage indirect access to SSH credentials.