sudo-users Digest, Vol 3, Issue 3

[Mike Murphy]

----- Original Message -----
From: <sudo-users-request at sudo.ws>
To: <sudo-users at sudo.ws>
Sent: Wednesday, March 05, 2003 8:00 PM
Subject: sudo-users Digest, Vol 3, Issue 3


<snip>
> Message: 1
> Date: Tue, 4 Mar 2003 16:07:05 -0500
> From: Ofer Inbar <cos at permabit.com>
> Subject: restricting command arguments?
> To: sudo-users at sudo.ws
> Message-ID: <20030304210705.GQ6481 at irregular-apocalypse.permabit.com>
> Content-Type: text/plain; charset=us-ascii
>
> I'd like to allow people to run a particular command with no password,
> and exactly two arguments, the second one of which is partly arbitrary.
> But I do not want to allow them to add any more arguments.  For example,
>  I want to allow "cmd -opt /foo/file",
>  but not allow "cmd -opt /foo/file /other/path"
>  or "cmd -opt /foo/file -opt2"
>
> I can have a rule like this:
>   ALL SHARED = NOPASSWD: /bin/cmd -opt /foo/*
>
> But that allows people to add arbitrarily many extra arguments after.
> I've looked through the man page and don't see anything helpful about
> this, but it seems very strange to me that sudo would allow you to
> restrict arguments with wildcards, but *not* allow you to prevent
> people from adding extra arguments.
>
> I searched the list archives and found this, which looks related:
>   http://www.sudo.ws/mailman/htdig/sudo-users/2001-May/001529.html
> There weren't any followups, though, and that poster's email address
> now bounces.

Have you tried putting /bin/cmd in a script file?  If only user foo and bar
are allowed to use the script, and only root is allowed to use
/bin/cmd, then the only piece of the jigsaw left is to count the number of
arguments.  As far as I understand it, shells will expand any
wildcards at the first opportunity.  So you should see from the number of
arguments passed down.  And you will probably want to do
some validation on the parameters as well, before you let them rip ....

Regards

Mike Murphy