-1

im trying to simplify my sudo configuration but not sure if sudo supports this configuration.

I have a "view" command alias which we use to provide access to log files:

Cmnd_Alias VIEW =   /bin/cat, \
                    /bin/zcat, \
                    /bin/grep, \
                    /usr/bin/zgrep, \
                    /bin/more, \
                    /usr/bin/head, \
                    /usr/bin/tail, \
                    /usr/bin/less, \
                    /usr/bin/zless

In the past, i have simply duplicated this block with the relevant files that users need access to:

Cmnd_Alias VIEW =   /bin/cat /var/log/messages, \
                    /bin/grep /var/log/messages, \
                    /bin/more /var/log/messages, \
                    /usr/bin/head /var/log/messages, \
                    /usr/bin/tail /var/log/messages, \
                    /usr/bin/less /var/log/messages, \
                    /bin/zcat /var/log/messages*.gz, \
                    /usr/bin/zgrep /var/log/messages*.gz, \
                    /usr/bin/zless /var/log/messages*.gz

Which works fine but gets a little crazy when you need to allow access to a large number of files.

To simplify can i use a nested command alias (obviously this syntax wont be correct, but something similar):

Cmnd_Alias VIEW_MESSAGELOG =   {VIEW} /var/log/messages, \
                               {VIEW} /var/log/messages*.gz
Cmnd_Alias VIEW_MAILLOG =   {VIEW} /var/log/maillog, \
                            {VIEW} /var/log/maillog*.gz

Or perhaps specify a list of files that these actions can be performed on?

2 Answers 2

1

It cannot work like that, read sudoers(5) man page

1

Perhaps this is not a job for "sudoers" but rather group-permissions? Can you just create a group (example: "auditors"), put the required users in the group, then just "chgrp auditors /var/log/*" followed by a "chmod g+r /var/log/*"?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .