12

This line is from my Ubuntu 14.04

root    ALL=(ALL:ALL) ALL

What is the meaning of the third ALL?

What is the difference between the above line and root ALL=(ALL) ALL?

2 Answers 2

17

While the sudoers manpage can be a bit initmidating, there are examples given which help clarify things:

 dgb     boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm

Then user dgb is now allowed to run /bin/ls as operator, but /bin/kill and /usr/bin/lprm as root.

We can extend this to allow dgb to run /bin/ls with either the user or group set to operator:

 dgb     boulder = (operator : operator) /bin/ls, (root) /bin/kill,\
         /usr/bin/lprm

We can infer that, given a sudoers line of the form:

A B = (C:D) E

A refers to the invoker, C is the target users that can be used, D refers to the groups that can be used and E refers to the commands that can be executed.

And:

 The reserved word ALL is a built-in alias that always causes a match to succeed.  It can be
 used wherever one might otherwise use a Cmnd_Alias, User_Alias, Runas_Alias, or Host_Alias.
 Attempting to define an alias named ALL will result in a syntax error.

So the second ALL specifies that the user can run the command as any user, and the third ALL specifies that the user has can run the command under any group.


If only (ALL) is specified instead of (ALL:ALL), then sudo cannot be used with -g by that user for those commands:

Runas_Spec
  A Runas_Spec determines the user and/or the group that a command may 
  be run as.             ...  The second defines a list of groups that
  can be specified via `sudo`'s `-g` option.  If both Runas_Lists are
  specified, the command may be run with any combination of users and
  groups listed in their respective Runas_Lists. If only the first is
  specified, the command may be run as any user in the list but no `-g`
  option may be specified.

(The examples above come from the same section.)

2
  • 1
    in above example can any one help me to understand what is boulder
    – Arun
    Commented Feb 24, 2021 at 11:18
  • 2
    @Arun boulder is a hostname. In most common situations today, you would just be using ALL to match all hosts.
    – muru
    Commented Feb 24, 2021 at 11:32
5

Found an interesting documentation

root ALL=(ALL:ALL) ALL

  • The first field indicates the username that the rule will apply to
    (root).

  • First “ALL” indicates that this rule applies to all hosts.

  • Second “ALL” indicates that the root user can run commands as all
    users.

  • Third “ALL” indicates that the root user can run commands as all
    groups.

  • Forth “ALL” indicates these rules apply to all commands.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .