Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on a sudoers file. What is the correct way to state the following?

Zero or more command line options, each starting with a single or double dash, followed by one or more characters. I want to effectively allow both long and short command line options, zero or more total, e.g. -v --variable -vb, etc.

I believe that the following would be the appropriate perl regex.

... <binary> (?:-{1,2}\w+)* <file>

I'm not sure exactly how to translate that into something bash /sudoers compatible.

share|improve this question
Am I interpreting you correctly, if you say that you want to be able to run the binary with any number of arguments - regardless of what they are? Or do you actually want to do some filtering here? – Kvisle Oct 31 '11 at 20:10
Any number of arguments, but they need to be in the syntax of actual arguments --value, -v, not potentially a second file name. – Tim Brigham Oct 31 '11 at 20:14
up vote 2 down vote accepted

The sudoers file allows shell-style wildcards, but it does not support regular expressions. For the specifics of what you can do natively, see the "Wildcards" section of the Sudoers manual.

The best thing to do in this situation is simply write a script that validates input using your regex, then either terminates with an error (if invalid) or passes the input on to the specified binary (if valid). You could write such a script easily using perl, Ruby, Python, or whatever pleases you most. Give your sudoers access to the script instead of the binary.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.