A PHP program I am working with (LConf) calls a script using sudo
.
I have allowed the user apache
to run the script and have tested with sudo -u apache /usr/local/LConf/lconf_deploy.sh
.
I am being prompted for a password when lconf_deploy.sh
calls /usr/bin/sudo -u icinga /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v
, but have no problems calling lines before or after this line.
After reading a lot (both on stackexchange and elsewhere on the internet) about what to do in this situation, I have disabled requiretty
and used NOPASSWD
for everything I can think of that affects this situation.
# cat /etc/sudoers | grep -v "#"
Defaults always_set_home
Defaults env_reset
Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin
root ALL=(ALL) ALL
apache ALL = NOPASSWD: /usr/local/LConf/lconf_deploy.sh
apache ALL = NOPASSWD: /usr/bin/sudo -u icinga /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v
apache ALL = NOPASSWD: /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v
icinga ALL = NOPASSWD: /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v
Is it possible to switch user context (or whatnot) using sudo
, while already "sudoing
"?
If not, how do I solve this problem? Note that /usr/local/LConf/LConfExport.pl
must be run as the user icinga
.
Thanks,
Matt
[updated with reference to mdpc's comment below]
User_Alias LCONF=apache,icinga
Defaults:LCONF !requiretty
LCONF ALL=(icinga) NOPASSWD: /usr/local/LConf/LconfExport.pl -o /etc/icinga/lconf -v
LCONF ALL= NOPASSWD: /usr/local/LConf/lconf_deploy.sh
Executing sudo -u apache /usr/local/LConf/lconf_deploy.sh.
still prompts for password
# cat /usr/local/LConf/lconf_deploy.sh
echo start of script
/usr/bin/sudo -u icinga /usr/local/LConf/LConfExport.pl -o /etc/icinga/lconf -v
/etc/init.d/icinga reload
# sudo -u apache /usr/local/LConf/lconf_deploy.sh
start of script
[sudo] password for apache:
Running configuration check.../etc/init.d/icinga: line 111: /var/icinga/icinga.chk: Permission denied
CONFIG ERROR! Reload aborted. See /var/icinga/icinga.chk for details.
Any assistance is appreciated.