Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a program that reads and writes packets to/from network interfaces, and normally I would add myself in the sudoers file and run the program like this:

sudo ./bridge

But now I need multiple users to run this program, but without giving them sudo rights, such that they could run the program like this:

./bridge

Does anyone know how can I accomplish this? I am running Scientific Linux 6.1 on a 64bit platform, if it helps.

Thanks, Claudiu

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

Add a sudo rule to allow that user to run your script. Run visudo and add something like this to the sudoers file:

Defaults!/path/to/bridge env_reset
alice, bill  ALL = (root) /path/to/bridge

Note that his allows the users to pass any argument to the /path/to/bridge program. Add "" at the end of the line to forbid passing any arguments.

For easier user management, you may prefer to define a group of users who are allowed to control the bridge. Replace alice, bill by %bridgers where bridgers is the name of the group.

Inside the bridge program, $SUDO_UID is the user ID of the user who invoked sudo. If the program requires that user to be in the USER variable, write a small wrapper shell script that sets USER=$SUDO_UID.

share|improve this answer
    
Thanks, I needed something like $SUDO_USER to get the username of the person that used sudo to start the program. –  Claudiu Feb 21 '12 at 7:16
add comment

You can restrict in sudoers the commands that are allowed to run with sudo.

Write a small script ./bridge that call sudo ./real-bridge and give the users the right to run ./real-bridge as root via sudo.

share|improve this answer
    
As I mentioned in my question, I don't want to give the users sudo rights; this would mess up some things in the program which are based on the $USER enviroment variable, not to mention I give them unlimited rights in the system :) –  Claudiu Feb 20 '12 at 12:56
3  
@Claudiu I just wanted to get sure, that you know that you can limit the commands which can be run by sudo. If the allowed commands have no security issues, you would not provide unlimited rights to the users. –  jofel Feb 20 '12 at 13:06
add comment

I'm not sure if it works with eth devices, but this people do with tun devices.

$ tail -n1 /etc/udev/rules.d/20-kvm.rules 
KERNEL=="tun",          NAME="net/%k", GROUP="mygoodusers", MODE="0660"

See - GROUP="mygoodusers", MODE="0660" - on that line. Of course you have to put each user into that group.

udevadm control --reload-rules

but until reboot you have to chmod/chown manually.

share|improve this answer
    
So, I guess I should put "eth" instead of "tun"? And "eth0"/"eth1"/"eth2" instead of "net/%k"? –  Claudiu Feb 20 '12 at 12:53
    
but until reboot you have to chmod/chown manually. By the way, what are the files on which I should chown/chmod? –  Claudiu Feb 20 '12 at 13:06
    
The example with tun device doesn't work with real network adapters. Use sudo for your problem, you can define command alias and group alias as well in /etc/sudoers, plus you will get logging for each usages of sudo ;) –  Jiri Xichtkniha Feb 20 '12 at 15:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.