14

How to give a sudo command permission for a specific time? is there any way to give rights to perform a specific command for 2 days only in sudoers file.?

1 Answer 1

19

The sudoers file does not support time based restriction but there is an easy method. Create a file with your alterations in /etc/sudoers.d/ (with sudo visudo -f /etc/sudoers.d/yourfile):

Add to a file (example: file.sh) the following

mv /etc/sudoers.d/yourfile /etc/sudoers.d/.yourfile

And this will disable your alterations:

 sudo at -f file.sh 2pm + 2 days

Example:

at -f file.sh 2pm + 2 days
warning: commands will be executed using /bin/sh
job 4 at Thu Oct 15 14:00:00 2015

In this case it would move the file over at 2 pm 2 days after you issue the command. The at manual has some options (you can use a time, days, weeks, months, years, keywords like next or add/subtract periodes). Have some tests with the option to make sure you understand it (Something to consider: it matters if you start the at before or after 2pm on the day itself.)

at also survives reboots so is a good tool to use for these kind of things. And you can toggle access ...

sudo mv /etc/sudoers.d/.yourfile /etc/sudoers.d/yourfile | at 2pm + 2 days
sudo mv /etc/sudoers.d/yourfile /etc/sudoers.d/.yourfile | at 2pm + 4 days
sudo mv /etc/sudoers.d/.yourfile /etc/sudoers.d/yourfile | at 2pm + 6 days
sudo mv /etc/sudoers.d/yourfile /etc/sudoers.d/.yourfile | at 2pm + 8 days

and make that user go nuts (wtf now I can do this).

The README in /etc/sudoers/:

# As of Debian version 1.7.2p1-1, the default /etc/sudoers file created on
# installation of the package now includes the directive:
# 
#   #includedir /etc/sudoers.d
# 
# This will cause sudo to read and parse any files in the /etc/sudoers.d 
# directory that do not end in '~' or contain a '.' character.
# 
# Note that there must be at least one file in the sudoers.d directory (this
# one will do), and all files in this directory should be mode 0440.
# 
# Note also, that because sudoers contents can vary widely, no attempt is 
# made to add this directive to existing sudoers files on upgrade.  Feel free
# to add the above directive to the end of your /etc/sudoers file to enable 
# this functionality for existing installations if you wish!
#
# Finally, please note that using the visudo command is the recommended way
# to update sudoers content, since it protects against many failure modes.
# See the man page for visudo for more information.

If I read this correctly it will not execute any file with a "." anywhere in the name. So the 1st mv command I placed the "." in front making it also invisible. If correctly assumed you can place a "." anywhere. Careful with the "~", that one is used as a "backup" feature by editors like gEdit.


at is not installed by default. To install

sudo apt-get install at
8
  • Thanx, i already thought of it but the situation is multiple users using the file for their own purpose so its not possible to backup and restore sudoers file every time bcoz other users are also modifying the same sudoers file so when i restore old file all the changes made by ohter users will be gone... Oct 9, 2015 at 7:46
  • 2
    How about this sir? Oh and might I suggest to your multiple users to also themself to use the sudoers.d with their own filename. Seems a lot better than editing sudoers.
    – Rinzwind
    Oct 9, 2015 at 9:37
  • @AbbasKapasi create a new file in /etc/sudoers.d that won't be used by your other users.
    – muru
    Oct 9, 2015 at 10:23
  • I think the command used all throughout the answer should have been mv, not cp.
    – Cthulhu
    Oct 9, 2015 at 10:55
  • 3
    where do you see cp? whistles innocently
    – Rinzwind
    Oct 9, 2015 at 11:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .