Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to add an entry to my suoders to allow one user to run a command with exactly one non-option argument.

# tail -1 /etc/sudoers
ALL     ALL = (:tool) NOPASSWD: /bin/echo [a-z]*
$ sudo -g tool /bin/echo abc def
abc def
$ sudo -g tool /bin/echo -abc def
[sudo] password for user: 

Can I do that using the sudoers sytnax? Or do I need to create a helper script?

share|improve this question
    
is it a set arguement like always -abc? or can it vary? –  Mike May 23 '13 at 13:10
    
The [a-z]* is already the argument I want. So it's a variable argument. (I use /bin/echo just for testing.) –  Elrond May 23 '13 at 13:26
add comment

1 Answer

To my knowledge, you cannot pass non-command arguments into sudo if that argument varies.

You can specify something like this:

users ALL=(ALL) NOPASSWD: /usr/bin/tail /some/file

This would allow the user to tail somefile but not other files.

If you need to pass a variable, I recommend a wrapper script.

Here is an example of an rsync wrapper:

https://sites.google.com/site/beingroot/articles/useful-scripts/wrapper-script-to-use-rsync-via-sudo

If you search google for sudo wrappers, you can find many more examples.

Be sure to hard code all paths and run sanity checks on the input if the user cannot be trusted.

share|improve this answer
1  
Should have sanity checks anyway. Trust no one! [/paranoid] –  Nathan C May 23 '13 at 13:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.