Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am trying to write to /etc/network/interfaces with a user that does not have root privileges.

The reason for wanting to write to this would be to allow the user to set a static IP since I am running a command line only server. What permission do I need to give user in etc/sudoers?

I do not want the user to have full root permissions. Just ability to edit this file.

share|improve this question

2 Answers 2

Instead of usingsudo, just set an ACL on the file:

$ ls -l /var/tmp/foo
-rw-rw---- 1 root root 4 Jul 31 15:26 /var/tmp/foo
$ sudo setfacl -m u:white:rw /var/tmp/foo
$ whoami
white
$ cat /var/tmp/foo
bar

Now the file is owned by 'root' but the user 'white' can read and write to it. The user 'white' can now use his/her favorite editor to edit the file.

share|improve this answer
    
A little confused. Is /var/tmp/foo = /etc/network/interfaces? Never really seen what you are trying to say there, I am pretty new to Linux. –  Keith Jul 31 at 19:46
    
It's just a file. You can use whatever file you want. –  Jeff White Jul 31 at 19:58
    
Ok thanks, I will have to try it out. –  Keith Jul 31 at 20:02
1  
Nice. I thought that ACLs could only be used to restrict permissions and not to grant them - nice to know it's not true! –  Rmano Jul 31 at 22:25

Prepare a script that do the editing you want, for example a script that write the correct file with the static IP (what to put in this script is out of the scope of this Q&A). Let's call this script /root/set_static_ip. (1)

Edit /etc/sudoers (2) (with visudo is better, it checks for sanity, it is very difficult to recover a system with an invalid sudoers file, even impossible from remote (3)), and add

user_name_to_authorize ALL=NOPASSWD: /root/set_static_ip 

Now that user is able to use sudo /root/set_static_ip without any password asked, and the script will run with all privileges; no other command will be allowed.

If you want the user to just replace a file with whatever they want, the script could simply be (call it /root/unsafe-overwrite-interface)

#! /bin/bash -e
#
cp /tmp/temp-iface.txt /etc/network/interfaces 
exit 0

... and you tell the user to edit /tmp/temp-iface.txt and then run sudo /root/unsafe-overwrite-interface --- enabling it in sudoers as specified above. Or you can add the user to an ACL list and give them write permission on the specific file.

But notice that if you do not check the file contents for safety, havoc will happen, either intentional or unintentional.


Footnotes:

(1) this script must be as safe as possible. Check inputs and so on. It will be executed with full permissions.

(2) in modern sudo installation, you can add a file to /etc/sudoers.d/ directory which is better --- will survive updates.

(3) I normally keep a terminal with a root session open (sudo -i) when I modify the sudoers mechanism, and a backup handy.

share|improve this answer
    
The only problem with this is that the static IP settings needs to be changed on demand. My understanding of the script that you reccomend would basically rewrite the /etc/network/interfaces file to whatever the /root/set_static_ip is. Unless you can make a script that asks the user to input IP address, gateway, etc... This I am not good enough to make. –  Keith Jul 31 at 15:18
    
You can write a script that accept parameters... but yes, this is the safest way. If you let the user edit the file blindly, what happen if they make an error? You can have your server out of reach... so the script need not only to ask in some way the parameters, but to check if they are safe. –  Rmano Jul 31 at 15:21
3  
Regarding /etc/sudoers, it's visudo, not sudoedit. –  saiarcot895 Jul 31 at 19:36
    
If someone is asking this kind of question, it is probably beyond their skills to write a safe bash script. There is a reason you cannot setuid root a bash script. –  rox0r Jul 31 at 21:38
    
@saiarcot895 thanks, corrected. –  Rmano Jul 31 at 22:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.