up vote 3 down vote favorite
share [g+] share [fb]

I want to be able to give a user on a system I administrate the ability to access file X, using command Y using sudo.

Is there a way to do this while allowing some flexibility over the arguments to command Y?

The following:

user ALL=NOPASSWD: /usr/bin/X /path/to/Y

Will allow the user to run X with Y as its only argument, but what if I wanted to allow the user to supply some optional arguments to X?

This:

user ALL=NOPASSWD: /usr/bin/X * /path/to/Y

Wouldn't be secure, as the the user could use the wildcard to to pass additional file arguments to X. I'd need something more restrictive.

Can I do this simply with sudo? Or do I need to use a different method?

link|improve this question
feedback

1 Answer

up vote 8 down vote accepted

Make a wrapper command that specifies the particular command line arguments and then give the user sudo access to that.

link|improve this answer
1  
+1: a wrapper script is usually the easiest and least error-prone approach to this problem. Another approach, if you are determined to do it entirely within sudo, is to use globbing - search for "Wildcards" in the sudoers man page and read carefully. – Paul Lathrop Jul 27 '09 at 15:41
@Paul: If you think it can be done with wildcards, why not post an answer with an example? I don't think wildcard are restrictive enough to be safely used. – SpoonMeiser Jul 27 '09 at 15:53
1  
FWIW, if I was doing this myself I'd probably use a Perl wrapper and explicitly parse the supplied parameters and crap out if any invalid parameters (or extra filenames) are supplied. – Alnitak Jul 27 '09 at 16:14
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.