19

I wish to add a file to the /etc/sudoers.d folder that includes a directive to allow www-data to run one specific script with no root password.

The directive is

www-data ALL=(ALL) NOPASSWD: /path/to/script.sh

If I visudo and add it to /etc/sudoers, there is no problem.

If I put that line in a file and copy it to /etc/sudoers.d, then visudo, it tells me that the file has a 'syntax error near line 1'.

Is there something else I need to put in the file, or something else I need to do to make it work?

I am running Ubuntu 18.

Thanks!

5
  • If you want the script to run at any interval, You can go for cron.. Nov 26, 2019 at 3:11
  • I do not want the script to run at an interval, only as and when called from the webapp (which is likely to be once or so a year) Nov 26, 2019 at 3:25
  • 2
    Just in case, file without newline at the end is incorrect UNIX text file.
    – Hauleth
    Nov 26, 2019 at 16:19
  • @Hauleth - as per the answer (which I can't accept until tomorrow), that was indeed the problem! Nov 26, 2019 at 17:28
  • 1
    visudo also has the -f flag you can use to edit a specific file. That way you can be sure that your files are always correct.
    – Dumitru
    Nov 29, 2019 at 8:50

2 Answers 2

22

I found out the problem - for files in /etc/sudoers.d, the file must not end at the directive, but on a new line. This is most easily shown with cat -A.

Invalid file:

root@server:/etc/sudoers.d# cat -A /etc/sudoers.d/testfile
www-data ALL=(ALL) NOPASSWD: /path/to/script.shroot@server:/etc/sudoers.d#

Valid file:

root@server:/etc/sudoers.d# cat -A /etc/sudoers.d/testfile
www-data ALL=(ALL) NOPASSWD: /path/to/script.sh$
root@server:/etc/sudoers.d#
6
  • 2
    i.e., the file must be a valid text file. If your file doesn't end in a newline, it's not a valid text file.
    – muru
    Nov 27, 2019 at 6:52
  • 1
    I had no idea that no newline meant it was an invalid text file - I just pasted the line into a file and saved it! Nov 28, 2019 at 17:19
  • Did you use nano or Vim?
    – muru
    Nov 29, 2019 at 3:34
  • Neither, the file exists within my project and I used the IDE editor (PHPStorm) to create the file, which was then deployed to the staging server and copied to /etc/sudoers.d for testing Nov 29, 2019 at 20:42
  • 2
    Blame the lame editor then. Any decent Unix editor will add that final newline if it's missing.
    – muru
    Nov 29, 2019 at 21:19
1

According to the /etc/sudoers.d/README, the filename should not have the . symbol in its name. This was the issue for me -- I have used the .conf extension.

# This will cause sudo to read and parse any files in the /etc/sudoers.d 
# directory that do not end in '~' or contain a '.' character.

Files should also be in 0440 mode.

Thus, my solution was to rename the file:

sudo mv /etc/sudoers.d/50-jenkins.conf /etc/sudoers.d/50-jenkins
sudo ls -al /etc/sudoers.d/
drwxr-xr-x   2 root root  4096 окт 10 17:47 .
drwxr-xr-x 157 root root 12288 окт 10 17:44 ..
-r--r-----   1 root root   268 окт 10 17:44 50-jenkins
-r--r-----   1 root root   958 мар 30  2016 README

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .