Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to have a sudoers entry that allows executing of only a particular command, without any extra arguments? I can't seem to find a resource that describes how command matching works with sudoers.

Say I want to grant sudo for /path/to/executable arg.

Does an entry like the following:

user ALL=(ALL) /path/to/executable arg

strictly allow sudo access to a command exactly matching that? That is, it doesn't grant user sudo privileges for /path/to/executable arg arg2?

share|improve this question

migrated from Oct 18 '12 at 10:04

This question came from our site for professional and enthusiast programmers.

I find the following in man sudoers, down near the Cmnd_List definition:

 A simple filename allows the user to run the command with any arguments
 he/she wishes.  However, you may also specify command line arguments
 (including wildcards).  Alternately, you can specify "" to indicate
 that the command may only be run without command line arguments.

This would seem to imply that specifically allowing "arg" would disallow "arg arg2". On the other hand, I've seen some inconsistency in how the sudoers file is processed on different OSes (Linux vs Solaris, for instance). So you should test for your own environment.

One, somewhat ugly, workaround: Create a separate executable script that runs the specified command with just the desired argument, and grant sudo access to that script instead of to the original command.

 /path/to/executable arg
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.