31

Everytime I want to be able to run something that requires me to be a sudoer too many times, I need to google for the formatting of /etc/sudoers to remind me again what exactly is the proper way to write it.

Now I see different writing styles in my sudoers file, which is the consequence of different google results over the months. I've also noticed that the second example (below) seems to work in XFCE, but not in Cinnamon (Gnome 3). This could be totally unrelated, but nontheless I'd like to know once and for all, what is the correct grammar of the sudoer line, and what is the difference between the given examples?

  1. redsandro ALL=NOPASSWD:/path/to/command
  2. redsandro ALL=(ALL) NOPASSWD:/path/to/command
  3. redsandro ALL=(ALL:ALL) NOPASSWD:/path/to/command

Also, what are all the ALL's for? One user, one command, yet I need to use the ALL keyword up to three times? Am I doing this wrong?

Of course, omitting NOPASSWD: makes you enter your password before you are permitted to run the command, but one point of confusion is the usage of = and :, for the final command that is the subject of the line can be prepended by either =, :, , or ), confusing grammar for similar semantics.

2
  • 6
    I also feel really frustrated with sudoers syntax. Reading the man page was even more frustrating: it describes the so-called concise and exact EBNF language, examples are exhaustively long. Hence I am not surprised to find so many threads here regarding this file.
    – m-ric
    Feb 14, 2013 at 16:20
  • 2
    Thanks for this. Been wanting to ask this question ever since I came across a sudoers file some years ago :-)
    – vahidg
    Sep 6, 2013 at 12:54

2 Answers 2

43

It's more than just a user and a command:


redsandro host=(user:group) tag:commands
  • host specifies the host names this line is valid for. Unless you are sharing asudoers file among different hosts that need different rules using the special value ALL meaning "all hosts" is a good choice.

  • user specifies which users you can use with the -u options to run the command. If you omit this you can't use the -u option.

  • group specifies which groups you can use with the -g options. If you omit it you can't use the -g option.

Both user and group understand the special value ALL as "all users/groups"

If you omit the whole (user:group) thing you can't use -u and -g but only run the command as root.

  • tag lets you specify some options, like NOPASSWD

So with your first example you can run the command as root but can't use -u and -g to run it as any other user or group.

With example 2. you can run the command as root or use -u to run it as any other user.

With 3. you can run the command as root or use -u or -g to run the command as any other user or group.

4
  • This is exactly what I was looking for. I have accepted your answer, and thank you for your efford.
    – Redsandro
    Apr 2, 2012 at 21:25
  • 1
    Final thought, can I use 127.0.0.1 or localhost as host for trivial added security?
    – Redsandro
    Apr 2, 2012 at 21:28
  • 6
    The manpage says 'Note sudo only inspects actual network interfaces; this means that IP address 127.0.0.1 (localhost) will never match. Also, the host name "localhost" will only match if that is the actual host name, which is usually only the case for non-networked systems.' Apr 2, 2012 at 22:18
  • 2
    Thanks. No hostname for me, especially since I want to be able to copy the sudoersfile to multiple machines. ALL it is.
    – Redsandro
    Apr 3, 2012 at 13:36
10

Let's take this one apart:
redsandro ALL=(ALL:ALL) NOPASSWD:/path/to/command

redsandro is the username we're giving permission to. Put a % at the front to make it apply to a group.

ALL is a name for this rule. Sudoers can do a lot more than just grant global permissions. That's where it gets complicated though.

= needs no explanation

ALL:ALL reads as (who_to_run_it_as:what_group_to_run_it_as). This way you can allow running a command, but only in the context of a specific user or group.

NOPASSWD: tells it to turn the password prompt off.

/path/to/command lets you specify specific commands path_to_commmand, another_command

The thing to remember is that while sudo is mostly used by home users to escalate to root privileges, it can be and is used to control access to specific commands in a much more granular way.

1
  • 1
    Thanks for the additional % and , another_command notes. Now I understand the %wheel line in the Fedora based distro.
    – Redsandro
    Apr 2, 2012 at 21:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .