Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to add a NOPASSWD entry for 'sudotest.sh' (or any script/binary that requires sudo) in my /etc/sudoers file (redhat) but in order to make it work, I must specify the full path. The following entry works just fine:

%jenkins ALL=(ALL)NOPASSWD:/home/vts_share/test/sudotest.sh

The problem is that the script might move to a different directory. I tried as giving /home/*/sudotest.sh but didn't work for me when I tried to execute sudo ./sudotest.sh,it gave me you dont have root permission

Note:I can't have permission to /bin/sh directory too.

share|improve this question
add comment

2 Answers

The full path is mandatory, otherwise the unprivileged user could create a new script with the same name at an arbitrary location, completely circumventing the security you're trying to implement.

share|improve this answer
    
Ding! Gold star. –  Shadur Feb 14 at 9:53
add comment

HBrujin is absolutely right: you can't do this, and it's a deliberate design decision. However, it can often be worked around, by realising that the script or scripts in question often do a lot of the same things under the hood, and granting privilege to sudo that thing, instead of the multiplicity of wrapper scripts.

For example, at one of my sites, I was constantly being pressured to allow "just one more"^n script to have sudo access to a user ccm_root. But once we realised that all these scripts ran the same privileged command /usr/bin/ccm under the hood, and that they were always being written and run by a small group of developers who were the de facto ccm administrators, we were instead able to grant sudo privileges to that command, and tell people to write scripts that sudo'ed that command instead of asking for privileges for the whole script.

This probably won't help at sites who use sudo solely for security control, but for those who use it for a mix of sanity control, security, and audit, this may be a helpful suggestion.

share|improve this answer
    
Spending time to analyse a problem usually pays off. –  Iain Feb 14 at 9:12
    
Alternatively you could create an account that had specific sudo permissions to a scripts directory, then give ssh keys to the developers so that they can run the commands via ssh. As a bonus you could use group permissions on the account (like wheel) and avoid having to sudo altogether. –  Roger Halliburton Feb 25 at 0:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.