I have a tricky situation. I need a user nagios to execute a specific command as another user jenkins -- However this command only works if the jenkins environment is fully loaded. Otherwise the command I'm running won't work, so I need to do a su - user type command.

Command works fine when ran from root:

/bin/su - -c "pm2 show proxy" jenkins

(I get the expected output)

When ran from nagios user:

nagios@srv01:~$ sudo /bin/su -c "pm2 show proxy" jenkins
[sudo] password for nagios:

visudo entries I've tried:

nagios  ALL=(root) NOPASSWD: /bin/su - -c "pm2 show proxy" jenkins

nagios  ALL=(jenkins) NOPASSWD: /bin/su - -c "pm2 show proxy" jenkins

Neither of the above work, it still asks for password.

IT WORKS if I simply grant nagios user full su permissions:

nagios ALL=(root) NOPASSWD: /bin/su

^^ this works, but NO, not granting full su permissions to this user.

Since it works when globally allowing su I'm assuming it's somewhere in my syntax.

Edit - In order to get around this issue I just put the command I want to run in a script and granted sudo to the script. However this is not ideal and adds an extra step in this workflow. Would much rather be able to run the command directly with sudo.

  • Can you try something like sudo -u jenkins -s ... – user9517 Nov 14 '17 at 22:17
  • Thanks but pm2 is picky -- I need to load the full user environment in order to run the pm2 command since it loads the path from environment. so, for example sudo -u jenkins -s whoami works fine but sudo -u jenkins -s pm2 just results in /bin/bash: pm2: command not found because it didn't load jenkins environment as is done with su - jenkins – emmdee Nov 14 '17 at 23:09
  • @emmdee just specify the full path to pm2 – jordanm Nov 15 '17 at 2:54
  • I know this sounds weird but the full path to pm2 changes depending on the version of node.js that's active at the time. When the target user (jenkins in this case) loads its profile it updates the path for the pm2 alias. I'm going to toy with wildcards in visudo to see if it works with * in the path. – emmdee Nov 15 '17 at 17:24
  • 1
    nagios ALL=(jenkins) NOPASSWD: pm2 show Proxy would be the sudoers entry for using sudo -i -u jenkins as nagios. However a possible simpler solution is to add the nagios ssh key into the Jenkins authorized keys file with a cmd= restriction, then you don’t need a sudo rule or nagios user at all. – eckes Feb 16 '19 at 17:44

If you need the login environment for jenkins then try to use the -i switch to sudo

-i [command] The -i (simulate initial login) option runs the shell specified by the password database entry of the target user as a login shell. This means that login-specific resource files such as .profile or .login will be read by the shell. If a command is specified, it is passed to the shell for execution via the shell's -c option. If no command is specified, an interactive shell is executed. sudo attempts to change to that user's home directory before running the shell. The security policy shall initialize the environment to a minimal set of variables, similar to what is present when a user logs in. The Command Environment section in the sudoers(5) manual documents how the -i option affects the environment in which a command is run when the sudoers policy is in use.

So something like

sudo -u jenkins -i pm2 show proxy

Should do what you want.

  • Hi, thanks - so what would the crontab entry look like? The full path to pm2 changes depending on different conditions (depends on version of node.js that's active for the user which switches around) – emmdee Nov 15 '17 at 17:20
  • Sorry I meant visudo not crontab, but it's too late to edit my comment :( – emmdee Nov 15 '17 at 17:28
  • 1
    I can confirm that sudo -u jenkins -i pm2 show proxy works fine when ran from root, same as my original command posted. Same issue though it still asks for password when ran from nagios user. I've tried nagios ALL=(jenkins) NOPASSWD: /usr/bin/sudo and nagios ALL=(jenkins) NOPASSWD: /usr/bin/sudo -u jenkins -i pm2 show proxy and nagios ALL=(jenkins) NOPASSWD: /usr/bin/sudo -u jenkins -i pm2 and all of them still ask for password when running sudo -u jenkins -i pm2 show proxy as the nagios user. – emmdee Nov 15 '17 at 17:34
  • @emmdee Did you ever figure this out? – Michael Ozeryansky Aug 7 '18 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.