Home / server / Questions / 478758
Accepted
Daniel
Asked: 2013-02-15 02:22:05 +0800 CST

Allow complex sudo command on Debian Linux

  • 772

I need to allow a specific command on a Debian Linux box for a single user. I've tried this in the /etc/sudoers file:

# User privilege specification
zabbix  ALL=NOPASSWD: /usr/bin/apt-get --print-uris -qq -y upgrade 2>/dev/null |awk '{print $2}' | wc | awk '{print $1}'

This does not work as expected. If I run the command as user zabbix with sudo, it asks for the password (although I have specified the NOPASSWD option).

However, this works:

# User privilege specification
zabbix  ALL=NOPASSWD: /usr/bin/apt-get

But has the drawback that all subcommands of apt-get are allowd. Is there a way how I can fix this to only allow a specific command?

linux

2 Answers

  1. You are probably falling foul of the way that redirection interacts with sudo. The redirection is performed at the calling user not the privileged user. It would probably be easier for you to wrap you command in a script and to then allow the zabbix user to run that script e.g.

    #!/bin/bash
/usr/bin/apt-get --print-uris -qq -y upgrade 2>/dev/null |awk '{print $2}' | wc | awk '{print $1}'

    the set sudoers as

    zabbix  ALL=NOPASSWD: /path/to/script

    Now the whole script will be run as the privileged user and not just the particular apt-get command. Do though ensure that the zabbix user cannot write to the script.

    • 25
  2. Best Answer

    I disagree with lain. Although it will work, You do not need awk to run as root. I would not be comfortable with this because you might be able to attack awk in some way. It is a full programming language interpreter after all.

    When one runs sudo /usr/bin/apt-get --print-uris -qq -y upgrade 2>/dev/null |awk '{print $2}' | wc | awk '{print $1}', They are actually running sudo /usr/bin/apt-get --print-uris -qq -y upgrade and then piping/redirecting as the calling user.

    Try this: zabbix ALL=NOPASSWD: /usr/bin/apt-get --print-uris -qq -y upgrade

    By the way, there is nothing wrong with putting this in a script as lain does and you could still do that. I would just avoid running awk as root if possible.

    • 10