3
$ sudo -u fish -g fish bash
Sorry, user steve is not allowed to execute '/bin/bash' as fish:fish on myserver.
$ sudo -u fish bash
$ groups
fish

What's the -g option meant to be used for, and why I can't use it? RHEL btw.

2
  • what does your /etc/sudoers file look like?
    – Mike
    Commented Apr 5, 2012 at 3:16
  • steve ALL=(ALL) ALL Commented Apr 11, 2012 at 3:26

2 Answers 2

7

Presumably because your sudoers file does not specify this. It is the difference between two lines like these: the first is the default but the second also allows you to run commands as any group, which is what you want.

  • steve ALL=(ALL) ...

  • steve ALL=(ALL:ALL) ...

2
  • Or just ALL:fish, or whatever.
    – ramruma
    Commented Apr 5, 2012 at 6:26
  • Thanks - in this case, it makes no difference whether I run it "as any group", but I was interested to know why. As noted in my comment to my Q, the line in sudoers is exactly as you guessed. Commented Apr 11, 2012 at 3:28
5

A wild man page appears!

-g group Normally, sudo sets the primary group to the one specified by the passwd database for the user the command is being run as (by default, root). The -g (group) option causes sudo to run the specified command with the primary group set to group. To specify a gid instead of a group name, use #gid. When running commands as a gid, many shells require that the '#' be escaped with a backslash ('\'). If no -u option is specified, the command will be run as the invoking user (not root). In either case, the primary group will be set to group.

You probably can't use it because you don't have permission to. If I'm reading the sudoers(5) manpage right, you need to explicitly specify a group list to to the Runas_user part of the sudoers entry in order to be able to use -g:

If only the first is specified, the command may be run as any user in the list but no -g option may be specified.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .