2

I am trying to add a NOPASSWD entry for 'sudotest.sh' (or any script/binary that requires sudo) in my /etc/sudoers file (redhat) but in order to make it work, I must specify the full path. The following entry works just fine:

%jenkins ALL=(ALL)NOPASSWD:/home/vts_share/test/sudotest.sh

The problem is that the script might move to a different directory. I tried as giving /home/*/sudotest.sh but didn't work for me when I tried to execute sudo ./sudotest.sh,it gave me you dont have root permission

Note:I can't have permission to /bin/sh directory too.

2 Answers 2

8

The full path is mandatory, otherwise the unprivileged user could create a new script with the same name at an arbitrary location, completely circumventing the security you're trying to implement.

1
2

HBrujin is absolutely right: you can't do this, and it's a deliberate design decision. However, it can often be worked around, by realising that the script or scripts in question often do a lot of the same things under the hood, and granting privilege to sudo that thing, instead of the multiplicity of wrapper scripts.

For example, at one of my sites, I was constantly being pressured to allow "just one more"^n script to have sudo access to a user ccm_root. But once we realised that all these scripts ran the same privileged command /usr/bin/ccm under the hood, and that they were always being written and run by a small group of developers who were the de facto ccm administrators, we were instead able to grant sudo privileges to that command, and tell people to write scripts that sudo'ed that command instead of asking for privileges for the whole script.

This probably won't help at sites who use sudo solely for security control, but for those who use it for a mix of sanity control, security, and audit, this may be a helpful suggestion.

2
  • Spending time to analyse a problem usually pays off.
    – user9517
    Feb 14, 2014 at 9:12
  • Alternatively you could create an account that had specific sudo permissions to a scripts directory, then give ssh keys to the developers so that they can run the commands via ssh. As a bonus you could use group permissions on the account (like wheel) and avoid having to sudo altogether. Feb 25, 2014 at 0:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .