I have a bash script which needs to perform some actions while using
sudo, both with root user permissions and permissions for other users, such as main user on a postgres database. These actions need to be performed without using a password, the main actions are to copy some files, specified by a list file, which are only accessible by root, to query whether a postgres database exists with a certain name and to take a dump from the database.
The user running the scripts is responsible for running quite a few different scripts. I understand that I can edit the
/etc/sudoers file with
visudo with a line like:
user ALL=(pg_dump_user) NOPASSWD:/usr/bin/pg_dump
user ALL=(pg_dump_user) NOPASSWD:/usr/bin/psql -lqt
I know that I can make the commands in the sudoers file a bit more specific, adding command options etc.
Would it be safer to call a script, which is only editable by
root and using that script in the sudoers entries. Obviously with this approach I need to ensure that the directory permissions for the script location are correct, or it can just be replaced with something malicious. Are there any other actions I can take to make this more secure?