sudoers question about cmnd_alias/list and directories.

trey85stang · 12-01-2010, 09:07 AM

I need to create a cmnd_alias that permits a handful of directories and all the commands that reside in that directory. but Cmnd_Alias seems to be ignoring directories.

I notice in the sudoers man page a Cmnd_List which supports directories but the syntax is a little confusing.

Here is what I would like to have working:

Code:

Cmnd_Alias TMP123 = /dir1, /dir2, /dir3

%mygroup ALL=(myuser) NOPASSWD: TMP123

That does not work the way I expect it to.

Here is what I am currently doing:

Code:

%mygroup ALL=(myuser) NOPASSWD: /dir1, /dir2, /dir3

This works but what I am giving you is only a snippet, I have dozens and dozens of groups users, and cmnd_alias I would like to setup. So using the above would get cumbersome without the Alias's working if I needed to make an edit.... or add a directory.

Any ideas?

unSpawn · 12-01-2010, 02:12 PM

Quote:

Originally Posted by trey85stang

I notice in the sudoers man page a Cmnd_List which supports directories (..)

'man sudoers' says that a directory is a fully qualified pathname ending in a '/'.

That works for me:

Code:

Cmnd_Alias DIRECTORIES = /sbin/, /bin/
username fqdn=DIRECTORIES

Code:

]$ sudo -l
User username may run the following commands on this host:
    (root) /sbin/, /bin/

sudo-1.7.2p1-9.el5_5 here.

trey85stang · 12-02-2010, 03:59 PM

Thanks for reply... That worked, I dont know why I did not catch that.