[sudo-users] sudo and groups
Galen.Johnson at sas.com
Fri Apr 21 08:53:47 EDT 2006
If you change that ID to allow all commands, can you get an ls on that directory? What is the exact error being logged in syslog (or wherever you have it logging to)? Are there any contradictory allowances for that user?
From: Timo Wendt [mailto:twendt at online.de]
Sent: Thursday, April 20, 2006 4:14 PM
To: Galen Johnson
Cc: sudo-users at sudo.ws
Subject: Re: [sudo-users] sudo and groups
It is no typo. I want to allow timo1 to run the command as timo. I
don't need to allow timo to run the command as himself. In production
I would use the following of course:
timo1 ALL= (timo) NOPASSWD: /tmp/dir1/dir2/cmd
I only used ALL to be able to try it with root as well.
Am 20.04.2006 um 22:09 schrieb Galen Johnson:
> Fair enough...is timo1 a typo or an alias? If a typo, I'd change
> that to timo and see if that works.
> -----Original Message-----
> From: Timo Wendt [mailto:twendt at online.de]
> Sent: Thursday, April 20, 2006 3:48 PM
> To: Galen Johnson
> Cc: sudo-users at sudo.ws
> Subject: Re: [sudo-users] sudo and groups
> User timo does have execute persmissions, its his own file and
> permissions are 740. dir2 is also hos own and therefore no problem.
> Due to his primary group shadow dir1 is also no problem. And all this
> works as designed without sudo if timo executes the command. Here is
> my sudoers entry:
> timo1 ALL= (ALL) NOPASSWD: /tmp/dir1/dir2/cmd
> It actually works fine if he tries to execute this as root by
> running: sudo /tmp/dir1/dir2/cmd
> Am 20.04.2006 um 21:38 schrieb Galen Johnson:
>> I doubt this is a sudo problem...this is a unix permission
>> problem. Chmod dir2 to 750 and the command to 750...in order to
>> traverse a directory, you have to have execute privs on it. I'm
>> surprised it works at all. Of course, it would help to see the
>> related sudoers entry for the user and command in question.
>> -----Original Message-----
>> From: sudo-users-bounces at courtesan.com [mailto:sudo-users-
>> bounces at courtesan.com] On Behalf Of Timo Wendt
>> Sent: Thursday, April 20, 2006 1:53 PM
>> To: sudo-users at sudo.ws
>> Subject: [sudo-users] sudo and groups
>> I have the following setup:
>> drwxr-x--- 3 root shadow 4096 20. Apr 19:31 dir1
>> insgesamt 4
>> drwxr----- 2 timo shadow 4096 20. Apr 19:32 dir2
>> insgesamt 4
>> -rwxr----- 1 timo shadow 13 20. Apr 19:32 cmd
>> Now I allowed a user timo1 to run cmd as user timo. User timo has
>> group shadow as his primary group. It doesn't work. It is possble
>> though to run the command when logging in as user timo. Somehow sudo
>> doesn't recognize that user timo has shadow as its primary group and
>> therefore the problem is dir1. As soon as I set 755 on it, it works.
>> Is this supposed to be like that or is there any option to use?
>> sudo-users mailing list <sudo-users at sudo.ws>
>> For list information, options, or to unsubscribe, visit:
More information about the sudo-users