Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I need to allow a certain user access to these commands:

sudo sync
echo 3 | sudo tee /proc/sys/vm/drop_caches

(This particular developer is doing some DB performance testing and flushing the fs cache gives them cleaner numbers, so please refrain from comments on why we're using this command.)

Can I restrict the user to a very specific command with sudo, e.g. tee /proc/sys/vm/drop_caches?

From what I understand, I can only restrict them to the command tee itself. I don't want to allow the user to be able to use tee as root on anything they want, however.

I guess the other option is to give them write access to that particular file, but is that crazy talk, i.e. giving some non-admin write access to a file in /proc?

Any pointers or ideas on the best way to restrict this are appreciated.

share|improve this question
add comment

1 Answer 1

up vote 3 down vote accepted

Sudo accepts command line arguments. So, you can very well go ahead and make changes to sudoers file such that tee is allowed when the argument is /proc/sys/vm/drop_caches for everything else, sudo will deny execution. If you want a tighter execution, drop in a neat and tidy shell script replacement under somewhere in /usr/bin or /usr/local/bin with tighter permissions and then in sudoers configuration, allow users to execute the script as root on that particular host.

share|improve this answer
    
Awesome, glad to hear. Every example I've come across only shows one specific command without arguments. Do you have an example of the syntax for the sudoers file? –  Banjer Dec 8 '11 at 20:05
    
I would be inclined to better go for a shell script, even if it could be only minimal lines. This way, you will be for sure aware that you have restricted users to only one shell script to run as root on a particular host and shell script does not do anything apart from just clearing the cache under sudo environment, no argument parsing no muckup with external resources. –  Nikhil Mulley Dec 8 '11 at 20:09
    
though man sudoers is sufficient; an online read may give you a quick start linuxhomenetworking.com/wiki/index.php/… –  Nikhil Mulley Dec 8 '11 at 20:09
    
If you are going for putting tee into sudoers file directly, then use the fullpath of the tee command. –  Nikhil Mulley Dec 8 '11 at 20:19
    
I put the commands into a shell script and dropped that into /usr/bin with appropriate permissions, then restricted the user to only /usr/bin/thescript. Thanks for the help. –  Banjer Dec 8 '11 at 21:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.