2

Suppose I have a user some_user and command /usr/bin/command. How can I execute this command as root by entering /usr/bin/command, but not sudo /usr/bin/command?

I tried to edit sudoers with visudo, but without success, password is not prompted, but I need to write sudo:

some_user ALL=(ALL:ALL) NOPASSWD: /usr/bin/command

Is there any difference between above command and www-data ALL=(ALL) NOPASSWD: /usr/bin/kill ?

Thank you.

4
  • Just to understand your question more clearly; Do you mean for e.g running an application (while being root) but As another user, without to type the password For-this-user ? – William Martens Nov 24 '20 at 12:01
  • I want to run a command as root (being another user), without entering sudo. /usr/bin/command, not sudo /usr/bin/command. – Andrew Fount Nov 24 '20 at 12:07
  • Okay understood; You have (in visudo, sudoers) access to SUDO privs On some_user, correct? (Not only it's "NOPASSWD" but, the privs too) ? – William Martens Nov 24 '20 at 12:17
  • 1
    Yes, you are right. – Andrew Fount Nov 24 '20 at 12:25
9

You can make /usr/bin/command setuid root. However, this will work for ALL users and not only the particular one. Ie. any user who types /usr/bin/command will run the command as root, without the need to specify a password - you cannot restrict this to particular users only. Also, when you set /usr/bin/command setuid root, there will be no possibility to run this command as non-root until you remove the setuid bit.

Btw. that's exactly how sudo works - /usr/bin/sudo is setuid root, so it automatically becomes root when you type sudo. If it weren't setuid root, it won't be able to switch to root.

But I suggest you don't set random commands setuid root. sudo was designed to use that way and it makes many security checks before actually let you run the command. By definition, if you type a command name in the terminal, you are running that command as your current user ID (unless the command elevates privileges by itself, eg. by being setuid root, or using sudo internally as in Tony's solution). sudo is there to clearly distinguish command being run as non-root from command being run as root. Therefore you shouldn't omit it.

2
  • 5
    You could make a copy of the command, then chown the copy to root and a group created specifically for that purpose, chmod the copy to -rwsr-x---, and make all users that should be allowed to use the command members of that group. This is how Ubuntu allows normal users to run wireshark, for example. But note this might open security holes if the command that's getting run is not intended to work that way; for example, if the command allows you to specify a file name to read or be written to, it'll be able to read/write every file on your system. – Guntram Blohm Nov 25 '20 at 9:18
  • @GuntramBlohm Note for safe file reading, you need to fork, and then drop privileges (by switching to the real user) in the child before opening the file. Don't just drop privileges in the master process and switch back, or you could get unwanted privilege escalation, like in the recent Ubuntu exploit – Ferrybig Nov 25 '20 at 17:05
5

Probably easiest to write a wrapper script. New script at /usr/local/bin/command that runs /usr/bin/command via sudo

/usr/local/bin/command

#!/bin/bash

echo "[I] Invoked by '${USER}', running as root" >&2
sudo /usr/bin/command $(printf '%q ' "$@")
5
  • 2
    "$@" will already pass the parameters properly. Actually, you are overescaping them. If you passed "he'llo" as parameter, command will receive he\'llo – Ángel Nov 24 '20 at 23:23
  • This can also be done by using an alias, at least in tcsh. E.g. I have "alias shut 'sudo systemctl poweroff'" in my .tcshrc file, and the "NOPASSWD: option for those commands in the sudoers file. I think this is cleaner than having a separate wrapper script. – jamesqf Nov 25 '20 at 3:05
  • Most installs will already just accept poweroff by itself, no need for the extra words. – Miral Nov 25 '20 at 6:33
  • Furthermore, $(printf '%q ' "$@") will actually do nothing to help with whitespace. If the arguments are aa and bb cc, the output will be aa bb\ cc, which gets split to the three arguments aa, bb<backslash>, cc. (with a real backslash, but the comment formatting messes it up.) Quotes don't work after expansions, and the same goes for backslashes which %q is so fond of using. – ilkkachu Nov 25 '20 at 9:06
  • An alias might also work, in the same vein as this answer. – blues Nov 25 '20 at 16:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.