Help on sudoers and Runas_Alias

ahamed101 · 01-27-2011, 06:52 PM

Hi All,

Thank you for your time. Request you to help with the sudoers issue I am facing.

I am trying to make use of Runas_Alias feature of sudoers. Some how I am not able to. Hope someone can help me. Thanks in advance.

I want the script /app2/run to be run as user "operator" when executed by the user engg. The /app2/run is just a sample script with "id" command in it for testing purpose. Anyways, here is the contents

Code:

$ cat run
#!/bin/ksh
echo "-----------------------------------------------"
id
echo "-----------------------------------------------"

In /etc/sudoers, I have the following entry

Code:

#
Runas_Alias OP=operator
engg         ALL =  (OP) NOPASSWD: /app2/run

I executed it using the -u option but no luck. I also tried giving the uid instead of username.

Code:

$ sudo -u operator ./run
sudo: unable to execute /app2/run: Permission denied

Is there anything I am doing wrong?

Here is my unix box version

Code:

$ uname -a
Linux  x86_64 GNU/Linux

Normal sudoers works, I mean if I have entry like

Code:

engg         ALL =  NOPASSWD: /app2/run

And on execution

Code:

$ sudo ./run
-----------------------------------------------
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),4(adm)
-----------------------------------------------

Thank You,
Ahamed

stress_junkie · 01-29-2011, 08:41 AM

Does the run script have execute permission?

Does the account that is supposed to execute the run script have permission to run it?

Try this just to see if this is the problem.

Code:

chmod a+x run

There are a lot of other ways that permission problems can arise. If the partition on which the script resides is mounted with the noexec option then the script cannot be directly executed but it can be sourced. Also, in your case, the operator account has got to have permission to see into the directory in which the run script resides. (Can operator see into the full path to the run script?) What would happen if the operator account did this?

Code:

ls /path/to/file

where /path/to/file is the path to the directory in which the file resides.