sudoers restriction only works when using "sudo", how to restrict regular usage?

Question

I have the following in my sudoers.d/nginx file:

deployer ALL=NOPASSWD: /etc/init.d/nginx reload

This works if I run the command as sudo:

$ sudo /etc/init.d/nginx start
[sudo] password for deployer: 
Sorry, user deployer is not allowed to execute '/etc/init.d/nginx start' as root on graduation.

However, when I run the command as non-sudo, it seems as if sudoers gets passed. The command still doesn't work, but that is because of other ownership errors, not the restriction in sudoers:

$ /etc/init.d/nginx start
nginx: [alert] could not open error log file: open() "/var/log/nginx/error.log" failed (13: Permission denied)
2012/12/30 20:59:49 [warn] 30054#0: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:12
2012/12/30 20:59:49 [emerg] 30054#0: open() "/var/log/nginx/access.log" failed (13: Permission denied)

Is this expected behaviour? And if so, why is this happening? I would expect the sudoers verification to happen before running a command. Do sudoers rules only apply to commands run as sudo? (makes sense, given its name).

And if this is the case, are there any other ways to restrict regular access to commands without using sudo?

Basically I would like my deployer user to do only two things:

• own its home directory /var/www
• be able to execute /etc/init.d/nginx reload

All other things should be off-limits (ideally even cd'ing outside the home directory)

Answer 1

This is expected behaviour, the sudoers file is only consulted when you run sudo so it denies the user access to the command and gives you the relevant error message.

When the user tries to run the command directly, sudo is not involved so you get the error messages produced by the individual commands failing because the user lacks privilege.

If you want to restrict the user to just one activity then you could allow them to log in via ssh and tie their keys to to the single command by using

command="/usr/bin/sudo /etc/init.d/nginx reload" ssh-rsa AAAAB3NzaC1...

With this configuration when the user logs in then the reload is performed and they are logged out.

If, at a later date, you decide that you need the user to carry out other operations then you can extend this idea.