3

I have this line in my /etc/sudoers file:

Cmnd_Alias MSGES = /usr/bin/tail -* /var/log/*, /bin/more * /var/log/*, /bin/cat * /var/log/*, /bin/grep * /var/log/*

And I have this:

level2  ALL = NOPASSWD: MSGES

The object is to allow the level2 user the ability to read log files in the /var/log folder.

But it ain't workin'. Is this the wrong way to do this? Do I have to set rights on the file differently?

Here's the rights on /var/log/messages:

-rw-r-----  1 root root 174161 2011-10-31 15:30 /var/log/messages

2 Answers 2

4

I just tried the following and it functions as expected.

Cmnd_Alias MSGES = /usr/bin/tail /var/log/*, /bin/more * /var/log/*, /bin/cat *\
/var/log/*, /bin/grep * /var/log/*
%wheel  ALL = NOPASSWD: MSGES

Looks like you are either missing the % for the group or the -* is the problem. I try to avoid doing wildcards like that for the command line options. I find it is easier to require them to be the last entries made.

EDIT - I would however suggest that you simply add the users to an admin group and allow that group read access to your log files. Totally your call however.

3
  • It was the wildcard characters. I took out the * from the more and cat commands and they seem to work. I need it for the grep and tail commands. so the new line is: Cmnd_Alias MSGES = /usr/bin/tail /var/log/*, /usr/bin/tail -* /var/log/*, /bin/more /var/log/*, /bin/cat /var/log/*, /bin/grep * /var/log/*
    – Ed Manet
    Oct 31, 2011 at 19:54
  • 2
    The -* and * aren't a problem if you understand how to use them i.e. if you have them, then there must be something to act upon on the command line.
    – user9517
    Oct 31, 2011 at 19:54
  • 4
    The above example is very very dangerous since the wildcard allows the users to specify additional files outside of /var/log. For example allowing the command pattern /usr/bin/tail /var/log/* allows the users to run the following: sudo tail /var/log/../../etc/shadow or sudo tail /var/log/messages /etc/shadow, both of which would then tail the shadow file. May 8, 2015 at 16:43
1

Try to change the group permissions of a files in the /var on "adm". After that, add yourself to the group.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .