I want to add an entry to my suoders to allow one user to run a command with exactly one non-option argument.

# tail -1 /etc/sudoers
ALL     ALL = (:tool) NOPASSWD: /bin/echo [a-z]*
$ sudo -g tool /bin/echo abc def
abc def
$ sudo -g tool /bin/echo -abc def
[sudo] password for user: 

Can I do that using the sudoers sytnax? Or do I need to create a helper script?

  • is it a set arguement like always -abc? or can it vary? – Mike May 23 '13 at 13:10
  • The [a-z]* is already the argument I want. So it's a variable argument. (I use /bin/echo just for testing.) – Elrond May 23 '13 at 13:26

To my knowledge, you cannot pass non-command arguments into sudo if that argument varies.

You can specify something like this:

users ALL=(ALL) NOPASSWD: /usr/bin/tail /some/file

This would allow the user to tail somefile but not other files.

If you need to pass a variable, I recommend a wrapper script.

Here is an example of an rsync wrapper:


If you search google for sudo wrappers, you can find many more examples.

Be sure to hard code all paths and run sanity checks on the input if the user cannot be trusted.

| improve this answer | |
  • 2
    Should have sanity checks anyway. Trust no one! [/paranoid] – Nathan C May 23 '13 at 13:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.