Limiting the use of `sudo -s`

Question

I am setting up Nagios on some of my Linux servers and have run into a bit of an issue. The check_ide_smart plugin requires root access to the system to run. To run it, I use the check_by_ssh plugin to ssh into the nagios account on the remote host, then run check_ide_smart using sudo.

I initially added the following lines to /etc/sudoers to allow the program to work:

nagios  ALL=NOPASSWD: /usr/lib/nagios/plugins/check_ide_smart

While this worked just fine when run locally, I was getting an issue when it was run from Nagios: no TTY was being spawned, which prevented the plugin from working.

I dug in the man page for sudo and found the -s option, which spawns a shell and executes the program in there. When I tried using sudo -s, I ran into permission issues since the -s apparently changes the command into /bin/bash -c /usr/lib/nagios/plugins/check_ide_smart, which is not allowed by the sudoers file. I tried changing the sudoers file to use that command instead, but that didn't work, and using quotation marks is a syntax error.

I eventually got it to work by using the following line in /etc/sudoers:

nagios ALL=/bin/bash

This feels really wrong to me since I'm allowing the nagios user to spawn a root shell, with which they can do anything.

At this point, I though that maybe, by putting the command in a shell script that the nagios user has read-only privileges on would work, so I created a shell script:

#!/bin/sh
/bin/bash -c /usr/lib/nagios/plugins/check_ide_plugin $@

Unfortunately, I could never get the passed parameters ($@) to correctly work with the plugin, so I don't know if this would work. Edit: I needed to quote the $@ for it to work. Thanks @derobert and @pjz. I still don't know if it would work since I got it to work using @Mike Arthur's solution.

Is there a way that I can get sudo -s to work while not allowing the spawning of a root shell?

Answer:

Added the following line to /etc/sudoers:

nagios ALL=NOPASSWD: /bin/bash -c /usr/lib/nagios/plugins/check_ide_smart *

Note the trailing asterisk; without it, this does not work. Thanks @Mike McQuaid for the answer.

Answer 1

nagios ALL=NOPASSWD: /bin/bash -c /usr/lib/nagios/plugins/check_ide_smart *

This should work and allow arguments.

Answer 2

FYI, you need to quote $@ in your shell script for it to work right:

#!/bin/sh
/bin/bash -c /usr/lib/nagios/plugins/check_ide_plugin "$@"

$@ is magic. From the bash manpage,

@ Expands to the positional parameters, starting from one. When the expansion occurs within double quotes, each parameter expands to a separate word. That is, "$@" is equivalent to "$1" "$2" ... If the double-quoted expansion occurs within a word, the expansion of the first parameter is joined with the beginning part of the original word, and the expansion of the last parameter is joined with the last part of the original word. When there are no positional parameters, "$@" and $@ expand to nothing (i.e., they are removed).

Also, starting bash won't spawn a pty; though I'm perplexed as to why your nagios plugin needs a terminal to run. It shouldn't. Maybe the actual problem is sudo's environment sanitization?

Answer 3

Instead of using sudo -s and launching a root shell, just allow your nagios user to use sudo without a tty using !requiretty. Your /etc/sudoers should have the following:

# Allow Nagios extra privs
Defaults:nagios !requiretty
nagios ALL=NOPASSWD: /usr/lib/nagios/plugins/check_ide_plugin

... which will allow direct sudo access, without a password, and without a tty. You can leave the "check_ide_plugin" off if you want sudo access to all the plugins.

We also use NRPE, which seems a little safer than check_by_ssh, but it requires a little more setup. Same idea in /etc/sudoers tho, just swap nagios with nrpe. :)

~tommy

Answer 4

Try the script again but put doublequotes around your $@:

#!/bin/sh
/bin/bash -c /usr/lib/nagios/plugins/check_ide_plugin "$@"

Answer 5

I don't think it's possible to use -s without spawning a root shell (assuming you need root privileges). The -s option is specifically there to spawn a shell. That's what -s means. From sudo(8):

-s [command]
    The -s (shell) option runs the shell specified by the SHELL
    environment variable if it is set or the shell as specified
    in passwd(5).  If a command is specified, it is passed to
    the shell for execution.  Otherwise, an interactive shell
    is executed.