Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a command that I run via sudo. This command needs to have its working directory set to the directory where the command is installed. The user that calls sudo has no permissions in this directory so I can not cd beforehand.

So basically what I like to be able to inlude in /etc/sudoers is something like :

appuser localhost = (appowner) NOPASSWD: cd /opt/app/bin \; ./binary

I know I can use a wrapper script around binary but I would rather not... Any suggestions?

share|improve this question
Why would you rather not use a script? – Skyhawk Jan 2 '13 at 9:11
Mostly because using wrappers would add another place to check when something goes wrong while running the application... – Willem Jan 2 '13 at 9:41
Thanks for helping out, guys! – Willem Jan 3 '13 at 9:48
up vote 3 down vote accepted

You will have to use a wrapper script. The parameters following the Runas Tag_Spec is interpreted as a Cmnd_List which is a list of commands that can be run by the specified user etc.

The solution is, as you note to use a wrapper script

appuser localhost = (appowner) NOPASSWD: /path/to/wrapper

Make sure that the wrapper script has suitable permissions and especially that it's not writeable.

share|improve this answer
That's what I was afraid for :-) Thanks for clarifying @Iain – Willem Jan 2 '13 at 9:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.