Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
$ sudo -u fish -g fish bash
Sorry, user steve is not allowed to execute '/bin/bash' as fish:fish on myserver.
$ sudo -u fish bash
$ groups

What's the -g option meant to be used for, and why I can't use it? RHEL btw.

share|improve this question
what does your /etc/sudoers file look like? – Mike Apr 5 '12 at 3:16
steve ALL=(ALL) ALL – Steve Bennett Apr 11 '12 at 3:26
up vote 6 down vote accepted

Presumably because your sudoers file does not specify this. It is the difference between two lines like these: the first is the default but the second also allows you to run commands as any group, which is what you want.

  • steve ALL=(ALL) ...

  • steve ALL=(ALL:ALL) ...

share|improve this answer
Or just ALL:fish, or whatever. – ramruma Apr 5 '12 at 6:26
Thanks - in this case, it makes no difference whether I run it "as any group", but I was interested to know why. As noted in my comment to my Q, the line in sudoers is exactly as you guessed. – Steve Bennett Apr 11 '12 at 3:28

A wild man page appears!

-g group Normally, sudo sets the primary group to the one specified by the passwd database for the user the command is being run as (by default, root). The -g (group) option causes sudo to run the specified command with the primary group set to group. To specify a gid instead of a group name, use #gid. When running commands as a gid, many shells require that the '#' be escaped with a backslash ('\'). If no -u option is specified, the command will be run as the invoking user (not root). In either case, the primary group will be set to group.

You probably can't use it because you don't have permission to. If I'm reading the sudoers(5) manpage right, you need to explicitly specify a group list to to the Runas_user part of the sudoers entry in order to be able to use -g:

If only the first is specified, the command may be run as any user in the list but no -g option may be specified.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.