up vote 0 down vote favorite
share [g+] share [fb]

I have a deploy user. I'm trying to make it to execute some operators without using sudo that i could enter a password for.

here's my visudo:

# /etc/sudoers
# This file MUST be edited with the 'visudo' command as root.
# See the man page for details on how to write a sudoers file.

Defaults        env_reset

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL) ALL

# Uncomment to allow members of group sudo to not need a password
# (Note that later entries override this, so you might need to move
# it further down)
# %sudo ALL=NOPASSWD: ALL
%team   ALL=(ALL)     ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# ubuntu user is default user in ec2-images.
# It needs passwordless sudo functionality.
ubuntu  ALL=(ALL) NOPASSWD:ALL

Cmnd_Alias DEPLOY= /home/deploy/.rbenv/shims/foreman, /sbin/start, /sbin/stop, /sbin/restart, /bin/mv
deploy ALL=(ALL) NOPASSWD:DEPLOY

and here's where deploy belongs:

ec2 ~: groups deploy
deploy : deploy team

I tried mv to move some file to /etc and it did't work.

I'm on Ubuntu 10.04 LTS 64bit.

Thanks!

link|improve this question
5  
Do you really need to permit arbitrary moving of files on the filesystem? Are you sure this cannot be handled by filesystem permissions? What would prevent an evil person from just doing a sudo mv /tmp/blah /etc/sudoers? If you are going to permit arbitrary file manipulations, you might as well give up, and just permit anything. – Zoredache Oct 20 '11 at 19:44
Sooo... what's the problem? Can you show the command you ran and the result? – MikeyB Oct 20 '11 at 19:49
1  
By the way, did you mean 'sudo without sudo' or 'sudo without password'? – MikeyB Oct 20 '11 at 19:50
2  
You generally don't want to give someone sudo access to /bin/mv - since that's a huge security risk. Giving them sudo access to a script that does the entire task is a lot safer (it's not OK if you give them access to edit said script). – Kvisle Oct 20 '11 at 19:58
1  
On that note, giving them sudo access to a script in their home directory really means 'sudo access to EVERYTHING'. – MikeyB Oct 20 '11 at 20:01
show 1 more comment
feedback

1 Answer

up vote 0 down vote

mv xxx /etc

Even if you specify what you did in your sudoers file, you still need to run sudo in your mv command.

But what you should be doing is allowing deploy to run a specific script that does the mv operation, but allowing arbitrary mv commands.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.