Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Everytime I want to be able to run something that requires me to be a sudoer too many times, I need to google for the formatting of /etc/sudoers to remind me again what exactly is the proper way to write it.

Now I see different writing styles in my sudoers file, which is the consequence of different google results over the months. I've also noticed that the second example (below) seems to work in XFCE, but not in Cinnamon (Gnome 3). This could be totally unrelated, but nontheless I'd like to know once and for all, what is the correct grammar of the sudoer line, and what is the difference between the given examples?

  1. redsandro ALL=NOPASSWD:/path/to/command
  2. redsandro ALL=(ALL) NOPASSWD:/path/to/command
  3. redsandro ALL=(ALL:ALL) NOPASSWD:/path/to/command

Also, what are all the ALL's for? One user, one command, yet I need to use the ALL keyword up to three times? Am I doing this wrong?

Of course, omitting NOPASSWD: makes you enter your password before you are permitted to run the command, but one point of confusion is the usage of = and :, for the final command that is the subject of the line can be prepended by either =, :, , or ), confusing grammar for similar semantics.

share|improve this question
1  
I also feel really frustrated with sudoers syntax. Reading the man page was even more frustrating: it describes the so-called concise and exact EBNF language, examples are exhaustively long. Hence I am not surprised to find so many threads here regarding this file. –  m-ric Feb 14 '13 at 16:20
1  
Thanks for this. Been wanting to ask this question ever since I came across a sudoers file some years ago :-) –  kishi Sep 6 '13 at 12:54
add comment

3 Answers 3

up vote 12 down vote accepted

It's more than just a user and a command:


redsandro host=(user:group) tag:commands
  • host specifies the host names this line is valid for. Unless you are sharing asudoers file among different hosts that need different rules using the special value ALL meaning "all hosts" is a good choice.

  • user specifies which users you can use with the -u options to run the command. If you omit this you can't use the -u option.

  • group specifies which groups you can use with the -g options. If you omit it you can't use the -g option.

Both user and group understand the special value ALL as "all users/groups"

If you omit the whole (user:group) thing you can't use -u and -g but only run the command as root.

  • tag lets you specify some options, like NOPASSWD

So with your first example you can run the command as root but can't use -u and -g to run it as any other user or group.

With example 2. you can run the command as root or use -u to run it as any other user.

With 3. you can run the command as root or use -u or -g to run the command as any other user or group.

share|improve this answer
    
This is exactly what I was looking for. I have accepted your answer, and thank you for your efford. –  Redsandro Apr 2 '12 at 21:25
    
Final thought, can I use 127.0.0.1 or localhost as host for trivial added security? –  Redsandro Apr 2 '12 at 21:28
2  
The manpage says 'Note sudo only inspects actual network interfaces; this means that IP address 127.0.0.1 (localhost) will never match. Also, the host name "localhost" will only match if that is the actual host name, which is usually only the case for non-networked systems.' –  Florian Diesch Apr 2 '12 at 22:18
    
Thanks. No hostname for me, especially since I want to be able to copy the sudoersfile to multiple machines. ALL it is. –  Redsandro Apr 3 '12 at 13:36
add comment

Let's take this one apart:
redsandro ALL=(ALL:ALL) NOPASSWD:/path/to/command

redsandro is the username we're giving permission to. Put a % at the front to make it apply to a group.

ALL is a name for this rule. Sudoers can do a lot more than just grant global permissions. That's where it gets complicated though.

= needs no explanation

ALL:ALL reads as (who_to_run_it_as:what_group_to_run_it_as). This way you can allow running a command, but only in the context of a specific user or group.

NOPASSWD: tells it to turn the password prompt off.

/path/to/command lets you specify specific commands path_to_commmand, another_command

The thing to remember is that while sudo is mostly used by home users to escalate to root privileges, it can be and is used to control access to specific commands in a much more granular way.

share|improve this answer
    
Thanks for the additional % and , another_command notes. Now I understand the %wheel line in the Fedora based distro. –  Redsandro Apr 2 '12 at 21:26
add comment

If you have numerous programs that you like to escalate privileges for, I've learned that creating a separate file eases the process for me. I found an excellent post in the forums and wrote about it here.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.