hello

does anybody know how i have to configure sudo so that unprivileged user can execute one speciefied program that uses other programs which also need root permission to run?

an example is wvdial: it reads/writes from/to privileged files (/etc/ppp/stuff...) accesses a device owned by root (/dev/ttyS1) and then starts a program owned by root (pppd)...

how can i tell sudo, that anyone can access these few files/devices?

thank you

although not always suitable, I'd say that a program like wvidial would best be handled just by using the suid bit on the executable, as it's a generally safe program in terms of system security

The manual page for sudoers(5) is quite exaustive to that topic, it should be able to answer all your questions. It would be something like the following line:

That would allow all users to run /usr/bin/wvdial as root.

On the other hand - for wvdial it wouldn't be really needed to be run as root at all! wvdial only needs access to that device and the files. You can make those files (at least) readable to a special group, chmod g+rw /dev/ttyS1 and make wvdial sgid to that special group which you put all those files in and the user. That has quite some advantages: An exploit in wvdial wouldn't make the system a big security risk and you can

well thank you, but if I set the mandantory files readable to my users, and i let them execute pppd, the connection always breaks after 1 second...

why is this?

besides: how do you set an executable suid root? thats a question I should have asked long beforte... :-)

thanks to everyone

cya

Not sure about the connection break, but here's a snip from somewhere on the SUID/SGID usage (it's also discussed in the chmod man pages):After, as root, you set the SUID bit on a program, anyone will then effectively become root while they are executing that program.

thanks

setting suid works now, but if I dial with another user than root, the pppd dies with exit code 2. i looked at the man pages what this means, it tells me

"error processing options given... two mutually exclusive options given."

and what is that????

dialing as root always works.

thanks for the help

cya

raven

Hm,

I don't use pppd, but:

Does it die for everyone except root? Can each user can have a custom config file in their home directory, or does pppd read from a central config file (in /etc maybe)? If the error is correct, pppd is recieving conflicting instructions from somewhere, and you might have to pick through the file(s) to find the conflict.
Not being familiar with it, that's about all I can offer.

the users dont have own config files, they dont even have home directories...

any other suggestion?

thanks

raven