The answer mentioning to set a host confused me, as I want to be able to have a sudo user be able to run privileged commands without requiring to consider such "host aspect"; any host should work, hence I use the special
ALL reserved word.
Let's assume you want all sudo users (i.e., Unix users which are members of the Unix group sudo) to run the following commands as superuser (root) without having to enter their passwords:
sudo dbus-monitor --system
First find out the executable's full path using
which iftop >
which dbus-monitor >
Assuming the main sudo configuration file
etc/sudoers contains the following directive (an Ubuntu default) ...
... then it is a best practice to add your configuration in its own separate file within the
/etc/sudoers.d/ directory, e.g.
/etc/sudoers.d/customizations. This way, you will not run into problems when an update to the original sudo package wants to change the original
/etc/sudoers file and the package manager notices conflicting edits done by you.
Run the following command to create and edit your own sudo customization file:
sudo visudo -f /etc/sudoers.d/customizations
visudo command makes sure that there are no syntax erros in the file when saving it - syntax errors would otherwise make sudo fail to read all its configuration files, thereby breaking any subsequent
sudo usage, effectively locking you out from any superuser usage, including fixing the syntax erros.
Now add the following lines to this file and save it:
%sudo ALL=NOPASSWD: /usr/sbin/iftop
%sudo ALL=NOPASSWD: /usr/bin/dbus-monitor --system
%sudo at the beginning of these lines indicate they are rules for all members of group ("
Changes to sudo configuration files, including new files within the
/etc/sudoers.d/ directory, take effect immediately - no sudo "restart" required.
Now notice what happens when running the following commands: (for testing purposes, any current sudo ticket, i.e. the timespan without requiring to reenter the password, can be directly revoked/timed-out by executing
iftop: fails with
You don't have permission to capture on that device (socket: Operation not permitted). This is because running the configured commands without the
sudo prefix behave unprivileged as usual.
sudo iftop: this command will now run successfully without requiring a password.
sudo iftop -B ("display bandwidth in bytes"): this command will also run successfully without requiring a password, because, as
man sudoers explains, "a simple file name [without parameters, in the configuration file] allows the user to run the command with any arguments they wish."
sudo dbus-monitor: the system will ask for password, because, as
man sudoers explains, "if a [command, in the configuration file] has associated command line arguments, then the arguments in the [command] must match exactly those given by the user on the command line (or match the wildcards if there are any)."
sudo dbus-monitor --system: this command will now run successfully without requiring a password.
sudo dbus-monitor --system --foo: the system will ask for password, as the arguments don't match the configuration.
Coming back to the initial question, for all users in the sudo group to be allowed to run the following commands without asking for their passwords ...
sudo shutdown -r now
sudo shutdown -P now
... create a sudo configuration file with the following content (assuming Ubuntu standard locations for the executables
%sudo ALL=NOPASSWD: /usr/sbin/reboot
%sudo ALL=NOPASSWD: /usr/sbin/shutdown -r now
%sudo ALL=NOPASSWD: /usr/sbin/shutdown -P now
Notice with this configuration, any sudo user can now also run
sudo reboot ... with any arguments, flags, and parameters without having to provide a password, including e.g.
sudo reboot --poweroff --force.
If this is not desired, but instead only
sudo reboot without any arguments/flags/parameters shall be allowed, its configuration line has to be changed to ...
%sudo ALL=NOPASSWD: /usr/sbin/reboot ""
... because as
man sudoers explains: "you can specify "" to indicate that the command may only be run without command line arguments."