Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need my web app to restart the dansguardian service (on CentOS) so it needs to run '/sbin/service dansguardian restart' I have a shellscript in /home/topological called apacherestart.sh which does the following:

#!/bin/sh
id=`id`
/sbin/service dansguardian restart
r=$?
return $r

This runs ok (logger statement in script for testing output to syslog, so I know it's running) To make it run, I put this in /etc/sudoers:

User_Alias      APACHE=www
# Cmnd alias specification
Cmnd_Alias      HTTPRESTART=/home/topological/apacherestart.sh,/sbin/e-smith/db,/etc/rc7.d/S91dansguardian
# Defaults specification
# User privilege specification
root    ALL=(ALL) ALL
APACHE  ALL=(ALL) NOPASSWD: HTTPRESTART

So far so good. But the service does not restart. To test this I created a user david, and fudged the uid/gid in /etc/passwd to be the same as www:

www:x:102:102:e-smith web server:/home/e-smith:/bin/false
david:x:102:102:David:/home/e-smith/files/users/david:/bin/bash

then logged in as david and tried to run the apacherestart.sh. The problem I get is:

/etc/rc7.d/S91dansguardian: line 51: /sbin/e-smith/db: Permission denied

even though S91dansguardian and db are in the sudoers command list.

Any ideas?

share|improve this question
add comment

3 Answers

up vote 0 down vote accepted

That doesn't look like a sudo error message to me -- it looks like a standard permissions message.

What are the permissions on /sbin/e-smith/db, and what is its shebang line (and that program's permissions), if it's a script?

Also, how are you calling the script? Just because it's mentioned in the sudoers list doesn't mean it's going to magically be special -- you actually need to call it via sudo.

share|improve this answer
    
permission is -r-xr-xr-- 1 root root –  David Shields Jun 10 '10 at 18:02
    
shebang is #!/usr/bin/perl -w –  David Shields Jun 10 '10 at 18:13
add comment

What is the e-smith script? Also, why are you running this all out of a Cmnd_Alias instead of lobbing it together in the apacherestart.sh script?

share|improve this answer
    
Cmd_alias was just apacherestart.sh. Stuffed other bits on just to see if that was where I was going wrong. The e-smith script is just called by the script started by service script. –  David Shields Jun 10 '10 at 18:02
add comment

Basing on Joe H. answer:

chmod a+rx /sbin/e-smith
chmod o+x /sbin/e-smith/db
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.