-1

im trying to simplify my sudo configuration but not sure if sudo supports this configuration.

I have a "view" command alias which we use to provide access to log files:

Cmnd_Alias VIEW =   /bin/cat, \
                    /bin/zcat, \
                    /bin/grep, \
                    /usr/bin/zgrep, \
                    /bin/more, \
                    /usr/bin/head, \
                    /usr/bin/tail, \
                    /usr/bin/less, \
                    /usr/bin/zless

In the past, i have simply duplicated this block with the relevant files that users need access to:

Cmnd_Alias VIEW =   /bin/cat /var/log/messages, \
                    /bin/grep /var/log/messages, \
                    /bin/more /var/log/messages, \
                    /usr/bin/head /var/log/messages, \
                    /usr/bin/tail /var/log/messages, \
                    /usr/bin/less /var/log/messages, \
                    /bin/zcat /var/log/messages*.gz, \
                    /usr/bin/zgrep /var/log/messages*.gz, \
                    /usr/bin/zless /var/log/messages*.gz

Which works fine but gets a little crazy when you need to allow access to a large number of files.

To simplify can i use a nested command alias (obviously this syntax wont be correct, but something similar):

Cmnd_Alias VIEW_MESSAGELOG =   {VIEW} /var/log/messages, \
                               {VIEW} /var/log/messages*.gz
Cmnd_Alias VIEW_MAILLOG =   {VIEW} /var/log/maillog, \
                            {VIEW} /var/log/maillog*.gz

Or perhaps specify a list of files that these actions can be performed on?

2 Answers 2

1

It cannot work like that, read sudoers(5) man page

1

Perhaps this is not a job for "sudoers" but rather group-permissions? Can you just create a group (example: "auditors"), put the required users in the group, then just "chgrp auditors /var/log/*" followed by a "chmod g+r /var/log/*"?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.