Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to have a sudoers entry that allows executing of only a particular command, without any extra arguments? I can't seem to find a resource that describes how command matching works with sudoers.

Say I want to grant sudo for /path/to/executable arg.

Does an entry like the following:

user ALL=(ALL) /path/to/executable arg

strictly allow sudo access to a command exactly matching that? That is, it doesn't grant user sudo privileges for /path/to/executable arg arg2?

share|improve this question

migrated from stackoverflow.com Oct 18 '12 at 10:04

This question came from our site for professional and enthusiast programmers.

1 Answer 1

I find the following in man sudoers, down near the Cmnd_List definition:

 A simple filename allows the user to run the command with any arguments
 he/she wishes.  However, you may also specify command line arguments
 (including wildcards).  Alternately, you can specify "" to indicate
 that the command may only be run without command line arguments.

This would seem to imply that specifically allowing "arg" would disallow "arg arg2". On the other hand, I've seen some inconsistency in how the sudoers file is processed on different OSes (Linux vs Solaris, for instance). So you should test for your own environment.

One, somewhat ugly, workaround: Create a separate executable script that runs the specified command with just the desired argument, and grant sudo access to that script instead of to the original command.

 #!/bin/bash
 /path/to/executable arg
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.