sudo-users Digest, Vol 3, Issue 3

Mike Murphy mike.murphy at
Wed Mar 5 15:04:12 EST 2003

----- Original Message -----
From: <sudo-users-request at>
To: <sudo-users at>
Sent: Wednesday, March 05, 2003 8:00 PM
Subject: sudo-users Digest, Vol 3, Issue 3

> Message: 1
> Date: Tue, 4 Mar 2003 16:07:05 -0500
> From: Ofer Inbar <cos at>
> Subject: restricting command arguments?
> To: sudo-users at
> Message-ID: <20030304210705.GQ6481 at>
> Content-Type: text/plain; charset=us-ascii
> I'd like to allow people to run a particular command with no password,
> and exactly two arguments, the second one of which is partly arbitrary.
> But I do not want to allow them to add any more arguments.  For example,
>  I want to allow "cmd -opt /foo/file",
>  but not allow "cmd -opt /foo/file /other/path"
>  or "cmd -opt /foo/file -opt2"
> I can have a rule like this:
>   ALL SHARED = NOPASSWD: /bin/cmd -opt /foo/*
> But that allows people to add arbitrarily many extra arguments after.
> I've looked through the man page and don't see anything helpful about
> this, but it seems very strange to me that sudo would allow you to
> restrict arguments with wildcards, but *not* allow you to prevent
> people from adding extra arguments.
> I searched the list archives and found this, which looks related:
> There weren't any followups, though, and that poster's email address
> now bounces.

Have you tried putting /bin/cmd in a script file?  If only user foo and bar
are allowed to use the script, and only root is allowed to use
/bin/cmd, then the only piece of the jigsaw left is to count the number of
arguments.  As far as I understand it, shells will expand any
wildcards at the first opportunity.  So you should see from the number of
arguments passed down.  And you will probably want to do
some validation on the parameters as well, before you let them rip ....


Mike Murphy

More information about the sudo-users mailing list