Specify command with quoted arguments in sudoers?
The General Case
I'm trying to enable a user to run a sudo command (with arguments) without a password. I can get the NOPASSWD directive to work, but only when the arguments don't contain quotation marks.
For example, this works:
# /etc/sudoers.d/sample
%sudo ALL=(ALL) NOPASSWD: /bin/echo foo
$ sudo echo foo
foo
But this doesn't, because quotation marks are interpreted literally:
# /etc/sudoers.d/sample
%sudo ALL=(ALL) NOPASSWD: /bin/echo "foo"
$ sudo echo "foo"
[sudo] password for rlue:
$ sudo echo "foo"
"foo"
My Specific Case
This is the command I'm trying to allow:
$ sudo sh -c 'echo XHCI > /proc/acpi/wakeup'
I actually got it to work with the following unquoted command:
%sudo ALL=(ALL) NOPASSWD: /bin/sh -c echo XHCI > /proc/acpi/wakeup
But since it calls out to sh -c, and since I clearly don't understand precisely what's going on, I'd like to be extra explicit about what I'm allowing.
How can I specify quoting for command arguments in the sudoers file?
sudo arguments
asked May 9 '18 at 3:02
Ryan LueRyan Lue
234110
bumped to the homepage by Community♦ 1 min ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
The General Case
I'm trying to enable a user to run a sudo command (with arguments) without a password. I can get the NOPASSWD directive to work, but only when the arguments don't contain quotation marks.
For example, this works:
# /etc/sudoers.d/sample
%sudo ALL=(ALL) NOPASSWD: /bin/echo foo
$ sudo echo foo
foo
But this doesn't, because quotation marks are interpreted literally:
# /etc/sudoers.d/sample
%sudo ALL=(ALL) NOPASSWD: /bin/echo "foo"
$ sudo echo "foo"
[sudo] password for rlue:
$ sudo echo "foo"
"foo"
My Specific Case
This is the command I'm trying to allow:
$ sudo sh -c 'echo XHCI > /proc/acpi/wakeup'
I actually got it to work with the following unquoted command:
%sudo ALL=(ALL) NOPASSWD: /bin/sh -c echo XHCI > /proc/acpi/wakeup
But since it calls out to sh -c, and since I clearly don't understand precisely what's going on, I'd like to be extra explicit about what I'm allowing.
How can I specify quoting for command arguments in the sudoers file?
sudo arguments
asked May 9 '18 at 3:02
Ryan LueRyan Lue
234110
bumped to the homepage by Community♦ 1 min ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
Thesudoersman page says "If a Cmnd has associated command line arguments, then the arguments ... must match exactly those given by the user...", so you're already being "extra explicit" about what you're allowing.
– dsstorefile1
May 9 '18 at 3:16
Sure, but for example,mv this that the otheris different frommv this that 'the other', and the unquoted syntax permits both. How can I be sure I haven't missed any edge cases?
– Ryan Lue
May 9 '18 at 3:32
1
If you're worried about edge cases, see serverfault.com/a/516002. Apparently, that is the "simple solution".
– dsstorefile1
May 9 '18 at 3:41
add a comment |
The General Case
I'm trying to enable a user to run a sudo command (with arguments) without a password. I can get the NOPASSWD directive to work, but only when the arguments don't contain quotation marks.
For example, this works:
# /etc/sudoers.d/sample
%sudo ALL=(ALL) NOPASSWD: /bin/echo foo
$ sudo echo foo
foo
But this doesn't, because quotation marks are interpreted literally:
# /etc/sudoers.d/sample
%sudo ALL=(ALL) NOPASSWD: /bin/echo "foo"
$ sudo echo "foo"
[sudo] password for rlue:
$ sudo echo "foo"
"foo"
My Specific Case
This is the command I'm trying to allow:
$ sudo sh -c 'echo XHCI > /proc/acpi/wakeup'
I actually got it to work with the following unquoted command:
%sudo ALL=(ALL) NOPASSWD: /bin/sh -c echo XHCI > /proc/acpi/wakeup
But since it calls out to sh -c, and since I clearly don't understand precisely what's going on, I'd like to be extra explicit about what I'm allowing.
How can I specify quoting for command arguments in the sudoers file?
sudo arguments
asked May 9 '18 at 3:02
Ryan LueRyan Lue
234110
The General Case
I'm trying to enable a user to run a sudo command (with arguments) without a password. I can get the NOPASSWD directive to work, but only when the arguments don't contain quotation marks.
For example, this works:
# /etc/sudoers.d/sample
%sudo ALL=(ALL) NOPASSWD: /bin/echo foo
$ sudo echo foo
foo
But this doesn't, because quotation marks are interpreted literally:
# /etc/sudoers.d/sample
%sudo ALL=(ALL) NOPASSWD: /bin/echo "foo"
$ sudo echo "foo"
[sudo] password for rlue:
$ sudo echo "foo"
"foo"
My Specific Case
This is the command I'm trying to allow:
$ sudo sh -c 'echo XHCI > /proc/acpi/wakeup'
I actually got it to work with the following unquoted command:
%sudo ALL=(ALL) NOPASSWD: /bin/sh -c echo XHCI > /proc/acpi/wakeup
But since it calls out to sh -c, and since I clearly don't understand precisely what's going on, I'd like to be extra explicit about what I'm allowing.
How can I specify quoting for command arguments in the sudoers file?
sudo arguments
sudo arguments
asked May 9 '18 at 3:02
Ryan LueRyan Lue
234110
asked May 9 '18 at 3:02
Ryan LueRyan Lue
234110
asked May 9 '18 at 3:02
Ryan LueRyan Lue
234110
asked May 9 '18 at 3:02
Ryan LueRyan Lue
234110
asked May 9 '18 at 3:02
Ryan LueRyan Lue
234110
234110
bumped to the homepage by Community♦ 1 min ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ 1 min ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
Thesudoersman page says "If a Cmnd has associated command line arguments, then the arguments ... must match exactly those given by the user...", so you're already being "extra explicit" about what you're allowing.
– dsstorefile1
May 9 '18 at 3:16
Sure, but for example,mv this that the otheris different frommv this that 'the other', and the unquoted syntax permits both. How can I be sure I haven't missed any edge cases?
– Ryan Lue
May 9 '18 at 3:32
1
If you're worried about edge cases, see serverfault.com/a/516002. Apparently, that is the "simple solution".
– dsstorefile1
May 9 '18 at 3:41
add a comment |
Thesudoersman page says "If a Cmnd has associated command line arguments, then the arguments ... must match exactly those given by the user...", so you're already being "extra explicit" about what you're allowing.
– dsstorefile1
May 9 '18 at 3:16
Sure, but for example,mv this that the otheris different frommv this that 'the other', and the unquoted syntax permits both. How can I be sure I haven't missed any edge cases?
– Ryan Lue
May 9 '18 at 3:32
1
If you're worried about edge cases, see serverfault.com/a/516002. Apparently, that is the "simple solution".
– dsstorefile1
May 9 '18 at 3:41
The
sudoers man page says "If a Cmnd has associated command line arguments, then the arguments ... must match exactly those given by the user...", so you're already being "extra explicit" about what you're allowing.– dsstorefile1
May 9 '18 at 3:16
The
sudoers man page says "If a Cmnd has associated command line arguments, then the arguments ... must match exactly those given by the user...", so you're already being "extra explicit" about what you're allowing.– dsstorefile1
May 9 '18 at 3:16
Sure, but for example,
mv this that the other is different from mv this that 'the other', and the unquoted syntax permits both. How can I be sure I haven't missed any edge cases?– Ryan Lue
May 9 '18 at 3:32
Sure, but for example,
mv this that the other is different from mv this that 'the other', and the unquoted syntax permits both. How can I be sure I haven't missed any edge cases?– Ryan Lue
May 9 '18 at 3:32
1
1
If you're worried about edge cases, see serverfault.com/a/516002. Apparently, that is the "simple solution".
– dsstorefile1
May 9 '18 at 3:41
If you're worried about edge cases, see serverfault.com/a/516002. Apparently, that is the "simple solution".
– dsstorefile1
May 9 '18 at 3:41
add a comment |
1 Answer
1
active
oldest
votes
edit: Warning, it appears that sudo does not safely handle spaces in the command, so it is not safe to use sudo in this way. https://unix.stackexchange.com/a/279142/39281
Instead of using quotes in the sudoers file, you can escape spaces using backslash:
%sudo ALL=(ALL) NOPASSWD: /bin/sh -c echo XHCI > /proc/acpi/wakeup
You can still use it as follows, because the user's shell handles the quoted argument anyway:
sudo /bin/sh -c 'echo XHCI > /proc/acpi/wakeup'
You could also consider putting a complex command into a script, as suggested in a comment. https://serverfault.com/a/516002
answered May 9 '18 at 6:40
Sam WatkinsSam Watkins
1056
This appears semantically identical to not having backslashes (that is, the arguments can still be grouped with quotation marks in every possible arrangement).
– Ryan Lue
May 9 '18 at 7:03
Someone commented: there's an other QA telling this is possibly unsafe: unix.stackexchange.com/questions/279125/… then removed their comment. But they were right, it is unsafe, seems like sudo is not safe to be used when there are spaces in the command name. Perhaps I am misusing it, or perhaps it is a rubbish insecure tool. If it is so easy to misuse, I suggest the latter.
– Sam Watkins
May 9 '18 at 7:53
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f442671%2fspecify-command-with-quoted-arguments-in-sudoers%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
edit: Warning, it appears that sudo does not safely handle spaces in the command, so it is not safe to use sudo in this way. https://unix.stackexchange.com/a/279142/39281
Instead of using quotes in the sudoers file, you can escape spaces using backslash:
%sudo ALL=(ALL) NOPASSWD: /bin/sh -c echo XHCI > /proc/acpi/wakeup
You can still use it as follows, because the user's shell handles the quoted argument anyway:
sudo /bin/sh -c 'echo XHCI > /proc/acpi/wakeup'
You could also consider putting a complex command into a script, as suggested in a comment. https://serverfault.com/a/516002
answered May 9 '18 at 6:40
Sam WatkinsSam Watkins
1056
This appears semantically identical to not having backslashes (that is, the arguments can still be grouped with quotation marks in every possible arrangement).
– Ryan Lue
May 9 '18 at 7:03
Someone commented: there's an other QA telling this is possibly unsafe: unix.stackexchange.com/questions/279125/… then removed their comment. But they were right, it is unsafe, seems like sudo is not safe to be used when there are spaces in the command name. Perhaps I am misusing it, or perhaps it is a rubbish insecure tool. If it is so easy to misuse, I suggest the latter.
– Sam Watkins
May 9 '18 at 7:53
add a comment |
edit: Warning, it appears that sudo does not safely handle spaces in the command, so it is not safe to use sudo in this way. https://unix.stackexchange.com/a/279142/39281
Instead of using quotes in the sudoers file, you can escape spaces using backslash:
%sudo ALL=(ALL) NOPASSWD: /bin/sh -c echo XHCI > /proc/acpi/wakeup
You can still use it as follows, because the user's shell handles the quoted argument anyway:
sudo /bin/sh -c 'echo XHCI > /proc/acpi/wakeup'
You could also consider putting a complex command into a script, as suggested in a comment. https://serverfault.com/a/516002
answered May 9 '18 at 6:40
Sam WatkinsSam Watkins
1056
This appears semantically identical to not having backslashes (that is, the arguments can still be grouped with quotation marks in every possible arrangement).
– Ryan Lue
May 9 '18 at 7:03
Someone commented: there's an other QA telling this is possibly unsafe: unix.stackexchange.com/questions/279125/… then removed their comment. But they were right, it is unsafe, seems like sudo is not safe to be used when there are spaces in the command name. Perhaps I am misusing it, or perhaps it is a rubbish insecure tool. If it is so easy to misuse, I suggest the latter.
– Sam Watkins
May 9 '18 at 7:53
add a comment |
edit: Warning, it appears that sudo does not safely handle spaces in the command, so it is not safe to use sudo in this way. https://unix.stackexchange.com/a/279142/39281
Instead of using quotes in the sudoers file, you can escape spaces using backslash:
%sudo ALL=(ALL) NOPASSWD: /bin/sh -c echo XHCI > /proc/acpi/wakeup
You can still use it as follows, because the user's shell handles the quoted argument anyway:
sudo /bin/sh -c 'echo XHCI > /proc/acpi/wakeup'
You could also consider putting a complex command into a script, as suggested in a comment. https://serverfault.com/a/516002
answered May 9 '18 at 6:40
Sam WatkinsSam Watkins
1056
edit: Warning, it appears that sudo does not safely handle spaces in the command, so it is not safe to use sudo in this way. https://unix.stackexchange.com/a/279142/39281
Instead of using quotes in the sudoers file, you can escape spaces using backslash:
%sudo ALL=(ALL) NOPASSWD: /bin/sh -c echo XHCI > /proc/acpi/wakeup
You can still use it as follows, because the user's shell handles the quoted argument anyway:
sudo /bin/sh -c 'echo XHCI > /proc/acpi/wakeup'
You could also consider putting a complex command into a script, as suggested in a comment. https://serverfault.com/a/516002
answered May 9 '18 at 6:40
Sam WatkinsSam Watkins
1056
edited May 9 '18 at 7:55
answered May 9 '18 at 6:40
Sam WatkinsSam Watkins
1056
answered May 9 '18 at 6:40
Sam WatkinsSam Watkins
1056
answered May 9 '18 at 6:40
Sam WatkinsSam Watkins
1056
1056
This appears semantically identical to not having backslashes (that is, the arguments can still be grouped with quotation marks in every possible arrangement).
– Ryan Lue
May 9 '18 at 7:03
Someone commented: there's an other QA telling this is possibly unsafe: unix.stackexchange.com/questions/279125/… then removed their comment. But they were right, it is unsafe, seems like sudo is not safe to be used when there are spaces in the command name. Perhaps I am misusing it, or perhaps it is a rubbish insecure tool. If it is so easy to misuse, I suggest the latter.
– Sam Watkins
May 9 '18 at 7:53
add a comment |
This appears semantically identical to not having backslashes (that is, the arguments can still be grouped with quotation marks in every possible arrangement).
– Ryan Lue
May 9 '18 at 7:03
Someone commented: there's an other QA telling this is possibly unsafe: unix.stackexchange.com/questions/279125/… then removed their comment. But they were right, it is unsafe, seems like sudo is not safe to be used when there are spaces in the command name. Perhaps I am misusing it, or perhaps it is a rubbish insecure tool. If it is so easy to misuse, I suggest the latter.
– Sam Watkins
May 9 '18 at 7:53
This appears semantically identical to not having backslashes (that is, the arguments can still be grouped with quotation marks in every possible arrangement).
– Ryan Lue
May 9 '18 at 7:03
This appears semantically identical to not having backslashes (that is, the arguments can still be grouped with quotation marks in every possible arrangement).
– Ryan Lue
May 9 '18 at 7:03
Someone commented: there's an other QA telling this is possibly unsafe: unix.stackexchange.com/questions/279125/… then removed their comment. But they were right, it is unsafe, seems like sudo is not safe to be used when there are spaces in the command name. Perhaps I am misusing it, or perhaps it is a rubbish insecure tool. If it is so easy to misuse, I suggest the latter.
– Sam Watkins
May 9 '18 at 7:53
Someone commented: there's an other QA telling this is possibly unsafe: unix.stackexchange.com/questions/279125/… then removed their comment. But they were right, it is unsafe, seems like sudo is not safe to be used when there are spaces in the command name. Perhaps I am misusing it, or perhaps it is a rubbish insecure tool. If it is so easy to misuse, I suggest the latter.
– Sam Watkins
May 9 '18 at 7:53
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f442671%2fspecify-command-with-quoted-arguments-in-sudoers%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
The
sudoersman page says "If a Cmnd has associated command line arguments, then the arguments ... must match exactly those given by the user...", so you're already being "extra explicit" about what you're allowing.– dsstorefile1
May 9 '18 at 3:16
Sure, but for example,
mv this that the otheris different frommv this that 'the other', and the unquoted syntax permits both. How can I be sure I haven't missed any edge cases?– Ryan Lue
May 9 '18 at 3:32
1
If you're worried about edge cases, see serverfault.com/a/516002. Apparently, that is the "simple solution".
– dsstorefile1
May 9 '18 at 3:41