3

So I'm currently trying to create a sudoers file, but I ran into something I can't figure out.

The end result I'm looking for is that I want users to be able to do something like:

sudo /usr/sbin/script.pl

But, instead of running as root, I'd like the script to run as "other_user".

I looked into the sudoers file, and I tried adding a line like:

pedro      ALL = (other_user) /usr/sbin/script.pl

But that only works if I specify the user by doing sudo -u other_user /usr/sbin/script.

Is there an (easy) way to have the script run as a specific user, without having to specify it in the command line?

Pedro
  • 31
  • 5
    Just curious why -u is too much work? – MDMarra Jun 21 '12 at 21:02
  • 1
    I'm actually porting a (huge) Solaris RBAC configuration to Red Hat. Solaris allows you to simply do "pfexec ", and if you have permission to, it'll run as whatever user you've specified in the config file.

    I guess the situation is that I personally don't care to use -u, but there are a bunch of scripts that would need to be picked through and modified, since instead of just replacing pfexec with sudo, every script would have to be modified to specify the particular user that is required for the different commands. :/

     – Pedro Jun 21 '12 at 21:30
  • To be fair sudo != pfexec – user9517 Jun 21 '12 at 21:44
  • Have the script start by switching users (or write a wrapper script that does that, then calls the actual script). You sudo to root, the script sudos to the user (it can, since it is root) and all is good. – Konerak Jun 22 '12 at 07:04

3 Answers3

11

I don't think there is a configuration parameter to do this. You could hack the source code and recompile it. You could also use an alias e.g.

alias sudo='sudo -u pedro'

but then you'd have to remember to out a \ infront of sudo for anything else

\sudo somecommand
user9517
  • 116,228
5

here is something that might work:

alias sudop='sudo -u pedro'
alias sudoa='sudo -u alice'

You still have to specify something in addition to sudo, but it is deeply concatenated and flows pretty easily to type. I use a variation of this for common sudo commands I need to run.

Quinn Murphy
  • 463
0

Do sudo chown other_user /usr/sbin/script; sudo chmod 6777 This will change the owner of the script to other_user, then set it as editable and executable by all, and finally set it to run as other_user.

sudo chown other_user /usr/sbin/script; sudo chmod 6555 //same as above but read-only sudo chown other_user /usr/sbin/script; sudo chmod 6755 //same as 6777 but can only be edited by other_user

See man chmod and man chown for more details

iracigt
  • 101