I want to be able to give a user on a system I administrate the ability to access file X, using command Y using sudo.

Is there a way to do this while allowing some flexibility over the arguments to command Y?

The following:

user ALL=NOPASSWD: /usr/bin/X /path/to/Y

Will allow the user to run X with Y as its only argument, but what if I wanted to allow the user to supply some optional arguments to X?


user ALL=NOPASSWD: /usr/bin/X * /path/to/Y

Wouldn't be secure, as the the user could use the wildcard to to pass additional file arguments to X. I'd need something more restrictive.

Can I do this simply with sudo? Or do I need to use a different method?


Make a wrapper command that specifies the particular command line arguments and then give the user sudo access to that.

  • 1
    +1: a wrapper script is usually the easiest and least error-prone approach to this problem. Another approach, if you are determined to do it entirely within sudo, is to use globbing - search for "Wildcards" in the sudoers man page and read carefully. – Paul Lathrop Jul 27 '09 at 15:41
  • @Paul: If you think it can be done with wildcards, why not post an answer with an example? I don't think wildcard are restrictive enough to be safely used. – SpoonMeiser Jul 27 '09 at 15:53
  • 1
    FWIW, if I was doing this myself I'd probably use a Perl wrapper and explicitly parse the supplied parameters and crap out if any invalid parameters (or extra filenames) are supplied. – Alnitak Jul 27 '09 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.