Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to be able to give a user on a system I administrate the ability to access file X, using command Y using sudo.

Is there a way to do this while allowing some flexibility over the arguments to command Y?

The following:

user ALL=NOPASSWD: /usr/bin/X /path/to/Y

Will allow the user to run X with Y as its only argument, but what if I wanted to allow the user to supply some optional arguments to X?


user ALL=NOPASSWD: /usr/bin/X * /path/to/Y

Wouldn't be secure, as the the user could use the wildcard to to pass additional file arguments to X. I'd need something more restrictive.

Can I do this simply with sudo? Or do I need to use a different method?

share|improve this question
up vote 8 down vote accepted

Make a wrapper command that specifies the particular command line arguments and then give the user sudo access to that.

share|improve this answer
+1: a wrapper script is usually the easiest and least error-prone approach to this problem. Another approach, if you are determined to do it entirely within sudo, is to use globbing - search for "Wildcards" in the sudoers man page and read carefully. – Paul Lathrop Jul 27 '09 at 15:41
@Paul: If you think it can be done with wildcards, why not post an answer with an example? I don't think wildcard are restrictive enough to be safely used. – SpoonMeiser Jul 27 '09 at 15:53
FWIW, if I was doing this myself I'd probably use a Perl wrapper and explicitly parse the supplied parameters and crap out if any invalid parameters (or extra filenames) are supplied. – Alnitak Jul 27 '09 at 16:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.