Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to add an entry to my suoders to allow one user to run a command with exactly one non-option argument.

# tail -1 /etc/sudoers
ALL     ALL = (:tool) NOPASSWD: /bin/echo [a-z]*
$ sudo -g tool /bin/echo abc def
abc def
$ sudo -g tool /bin/echo -abc def
[sudo] password for user: 

Can I do that using the sudoers sytnax? Or do I need to create a helper script?

share|improve this question
is it a set arguement like always -abc? or can it vary? – Mike May 23 '13 at 13:10
The [a-z]* is already the argument I want. So it's a variable argument. (I use /bin/echo just for testing.) – Elrond May 23 '13 at 13:26
up vote 5 down vote accepted

To my knowledge, you cannot pass non-command arguments into sudo if that argument varies.

You can specify something like this:

users ALL=(ALL) NOPASSWD: /usr/bin/tail /some/file

This would allow the user to tail somefile but not other files.

If you need to pass a variable, I recommend a wrapper script.

Here is an example of an rsync wrapper:

If you search google for sudo wrappers, you can find many more examples.

Be sure to hard code all paths and run sanity checks on the input if the user cannot be trusted.

share|improve this answer
Should have sanity checks anyway. Trust no one! [/paranoid] – Nathan C May 23 '13 at 13:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.