Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to write to /etc/network/interfaces with a user that does not have root privileges.

The reason for wanting to write to this would be to allow the user to set a static IP since I am running a command line only server. What permission do I need to give user in etc/sudoers?

I do not want the user to have full root permissions. Just ability to edit this file.

share|improve this question

Instead of usingsudo, just set an ACL on the file:

$ ls -l /var/tmp/foo
-rw-rw---- 1 root root 4 Jul 31 15:26 /var/tmp/foo
$ sudo setfacl -m u:white:rw /var/tmp/foo
$ whoami
$ cat /var/tmp/foo

Now the file is owned by 'root' but the user 'white' can read and write to it. The user 'white' can now use his/her favorite editor to edit the file.

share|improve this answer
A little confused. Is /var/tmp/foo = /etc/network/interfaces? Never really seen what you are trying to say there, I am pretty new to Linux. – Keith Jul 31 '14 at 19:46
It's just a file. You can use whatever file you want. – Jeff White Jul 31 '14 at 19:58
Ok thanks, I will have to try it out. – Keith Jul 31 '14 at 20:02
Nice. I thought that ACLs could only be used to restrict permissions and not to grant them - nice to know it's not true! – Rmano Jul 31 '14 at 22:25

Prepare a script that do the editing you want, for example a script that write the correct file with the static IP (what to put in this script is out of the scope of this Q&A). Let's call this script /root/set_static_ip. (1)

Edit /etc/sudoers (2) (with visudo is better, it checks for sanity, it is very difficult to recover a system with an invalid sudoers file, even impossible from remote (3)), and add

user_name_to_authorize ALL=NOPASSWD: /root/set_static_ip 

Now that user is able to use sudo /root/set_static_ip without any password asked, and the script will run with all privileges; no other command will be allowed.

If you want the user to just replace a file with whatever they want, the script could simply be (call it /root/unsafe-overwrite-interface)

#! /bin/bash -e
cp /tmp/temp-iface.txt /etc/network/interfaces 
exit 0

... and you tell the user to edit /tmp/temp-iface.txt and then run sudo /root/unsafe-overwrite-interface --- enabling it in sudoers as specified above. Or you can add the user to an ACL list and give them write permission on the specific file.

But notice that if you do not check the file contents for safety, havoc will happen, either intentional or unintentional.


(1) this script must be as safe as possible. Check inputs and so on. It will be executed with full permissions.

(2) in modern sudo installation, you can add a file to /etc/sudoers.d/ directory which is better --- will survive updates.

(3) I normally keep a terminal with a root session open (sudo -i) when I modify the sudoers mechanism, and a backup handy.

share|improve this answer
The only problem with this is that the static IP settings needs to be changed on demand. My understanding of the script that you reccomend would basically rewrite the /etc/network/interfaces file to whatever the /root/set_static_ip is. Unless you can make a script that asks the user to input IP address, gateway, etc... This I am not good enough to make. – Keith Jul 31 '14 at 15:18
You can write a script that accept parameters... but yes, this is the safest way. If you let the user edit the file blindly, what happen if they make an error? You can have your server out of reach... so the script need not only to ask in some way the parameters, but to check if they are safe. – Rmano Jul 31 '14 at 15:21
Regarding /etc/sudoers, it's visudo, not sudoedit. – saiarcot895 Jul 31 '14 at 19:36
If someone is asking this kind of question, it is probably beyond their skills to write a safe bash script. There is a reason you cannot setuid root a bash script. – rox0r Jul 31 '14 at 21:38
@saiarcot895 thanks, corrected. – Rmano Jul 31 '14 at 22:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.