LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   Imposing quotes/escapes on command allowed by sudo (https://www.linuxquestions.org/questions/linux-security-4/imposing-quotes-escapes-on-command-allowed-by-sudo-701572/)

blackhole54 02-02-2009 02:36 AM
Imposing quotes/escapes on command allowed by sudo
 
Hi,

I want to allow a user to be able to execute one of the following commands:

Code:
sudo grep -i connect\ time /var/log/messages
sudo grep -i "connect time" /var/log/messages
but not the command

Code:
sudo grep -i connect time /var/log/messages
I have tried the following lines in /etc/sudoers:

Code:
somebody        ALL=NOPASSWD: /bin/grep -i connect\ time /var/log/messages
somebody        ALL=NOPASSWD: /bin/grep -i connect\\\ time /var/log/messages
somebody        ALL=NOPASSWD: /bin/grep -i "connect time" /var/log/messages
somebody        ALL=NOPASSWD: /bin/grep -i \"connect time\" /var/log/messages
somebody        ALL=NOPASSWD: /bin/grep -i \\\"connect time\\\" /var/log/messages
Each of those either permits the command I don't want to permit or is rejected by visudo as invalid.

Any suggestions?

Thanks in advance.

gilead 02-02-2009 07:08 PM
Offhand I can't think of a way to do that. But you could create a script that only root can run containing the command you want to allow (without sudo) and add that script to /etc/sudoers.

blackhole54 02-04-2009 03:29 AM
OK. Thanks for the response.

jschiwal 02-04-2009 05:56 AM
Sorry, retesting my answer it didn't work. One thing you could try is replacing the space with a dot which would match. The user would have to enter the dot in the command as well however.

blackhole54 02-05-2009 01:29 AM
Quote:
Originally Posted by jschiwal (Post 3431692)
One thing you could try is replacing the space with a dot which would match. The user would have to enter the dot in the command as well however.
Yeah. That works. Thanks.

ymicromed 06-29-2016 09:52 AM
Hello,

You can create script1 with commands and arguments with quotes like:

/usr/sbin/asterisk -rx "sip show peers"

Allow the user to run this script by adding him to sudoers "visudo"

user ALL= NOPASSWD: /path/script1

Create script2 and put inside it

#!/bin/bash
sudo /path/script1

Run the script2 normally without sudo.
./script2
use script2 to be called by other services.

I have tested this solution.

I hope this will help.


All times are GMT -5. The time now is 07:37 PM.