visudo: How to let a user run only a certain program as root?

Ryan Hoots · 09-08-2011, 10:34 AM

I have scoured the internet (and the Debian man files) to figure out how to allow a user access to only one program as root, using sudo.
I use root for my administrative stuff, but there's one program my normal user, ryan, needs to run. That program is service. I need to be able to run that program, preferably without entering my password every time, so I can start or stop gdm3 whenever I want (I don't use GNOME much).
What I need to know is how to tell visudo that. This line doesn't pass the parse check:

Code:

ryan ALL=(ALL) service

What do I need to type to get it to work? Thanks.

SL00b · 09-08-2011, 10:54 AM

Try it this way... it should get you the command and handle the password issue the way you want:

Code:

ryan ALL =  NOPASSWD:/sbin/service

Ryan Hoots · 09-08-2011, 11:34 AM

Quote:

Originally Posted by SL00b

Try it this way... it should get you the command and handle the password issue the way you want:

Code:

ryan ALL =  NOPASSWD:/sbin/service

Didn't work. Here's what I got:

Code:

ryan@ryanD610:~$ sudo service gdm3 start
Sorry, user ryan is not allowed to execute '/usr/sbin/service gdm3 start' as root on ryanD610.*****.

Should I replace NOPASSWD:/sbin/service/service with NOPASSWD:/usr/sbin/service?

SL00b · 09-08-2011, 11:43 AM

Quote:

Originally Posted by Ryan Hoots

Should I replace NOPASSWD:/sbin/service/service with NOPASSWD:/usr/sbin/service?

Correct.

Ryan Hoots · 09-08-2011, 12:12 PM

Quote:

Originally Posted by SL00b

Correct.

It's working. Thanks, SL00b.

propofol · 09-09-2011, 01:22 AM

One other option: try 'super'. Add the required user to /etc/super.tab

Regards,
Stefan

Ryan Hoots · 09-09-2011, 09:20 AM

Quote:

Originally Posted by propofol

One other option: try 'super'. Add the required user to /etc/super.tab

Regards,
Stefan

Sounds interesting... I'll look into that...