I have the following in my
deployer ALL=NOPASSWD: /etc/init.d/nginx reload
This works if I run the command as sudo:
$ sudo /etc/init.d/nginx start [sudo] password for deployer: Sorry, user deployer is not allowed to execute '/etc/init.d/nginx start' as root on graduation.
However, when I run the command as non-sudo, it seems as if sudoers gets passed. The command still doesn't work, but that is because of other ownership errors, not the restriction in sudoers:
$ /etc/init.d/nginx start nginx: [alert] could not open error log file: open() "/var/log/nginx/error.log" failed (13: Permission denied) 2012/12/30 20:59:49 [warn] 30054#0: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:12 2012/12/30 20:59:49 [emerg] 30054#0: open() "/var/log/nginx/access.log" failed (13: Permission denied)
Is this expected behaviour? And if so, why is this happening? I would expect the
sudoers verification to happen before running a command. Do sudoers rules only apply to commands run as
sudo? (makes sense, given its name).
And if this is the case, are there any other ways to restrict regular access to commands without using
Basically I would like my deployer user to do only two things:
- own its home directory
- be able to execute
All other things should be off-limits (ideally even cd'ing outside the home directory)