2

I'm working on a sudoers file. What is the correct way to state the following?

Zero or more command line options, each starting with a single or double dash, followed by one or more characters. I want to effectively allow both long and short command line options, zero or more total, e.g. -v --variable -vb, etc.

I believe that the following would be the appropriate perl regex.

... <binary> (?:-{1,2}\w+)* <file>

I'm not sure exactly how to translate that into something bash /sudoers compatible.

2
  • Am I interpreting you correctly, if you say that you want to be able to run the binary with any number of arguments - regardless of what they are? Or do you actually want to do some filtering here?
    – Kvisle
    Oct 31, 2011 at 20:10
  • 1
    Any number of arguments, but they need to be in the syntax of actual arguments --value, -v, not potentially a second file name. Oct 31, 2011 at 20:14

1 Answer 1

2

The sudoers file allows shell-style wildcards, but it does not support regular expressions. For the specifics of what you can do natively, see the "Wildcards" section of the Sudoers manual.

The best thing to do in this situation is simply write a script that validates input using your regex, then either terminates with an error (if invalid) or passes the input on to the specified binary (if valid). You could write such a script easily using perl, Ruby, Python, or whatever pleases you most. Give your sudoers access to the script instead of the binary.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .