Run sudo as another non-root user and save in this user's home directory

Question

I added a new group: ircuser and a new user: ircuser

In visudo I placed this line:

myuser localhost=(ircuser) NOPASSWD: /usr/bin/irssi

Created ircuser directory, where config files, caches, etc should be saved:

drwxrwx--- 2 ircuser ircuser 4096 Mar  2 10:28 ircuser

When issuing the command:

sudo -Hu ircuser /usr/bin/irssi

or

sudo -u ircuser /usr/bin/irssi

The program can't save the config file in the ircuser directory.

** ERROR **: Couldn't create /home/myuser/_web/ircuser/.irssi directory
aborting...
Aborted

But, it is being run as ircuser:

ps auxw | grep irssi
ircuser  11962  0.0  0.0  23684  2504 pts/6    S+   11:18   0:00 /usr/bin/irssi

So, albeit irssi is run by ircuser it can't write to a directory owned by the same user? What do I need to change to allow it saving there?

Answer 1

The problem probably lies in not having eXecute permission in one of the parent directories leading up to ircuser's home directory. In order for any user to traverse, not necessarily look into a directory, that user must have execute permission either via a group, or via other. If you have these permissions:

drwxrwx--- 2 myuser myuser 4096 Mar  2 10:28 /home/myuser

And ircuser is not part of the myuser group, then ircuser can't access any file underneath even if it has permissions for that directory. If you try this instead:

drwxrwx--x 2 myuser myuser 4096 Mar  2 10:28 /home/myuser

Then ircuser can't browse myuser's home directory, but it can potentially access some file beneath it such as /home/myuser/_web/ircuser

UPDATE: A few more details I left out from the above description. Permissions are evaluated as you traverse the file system. It's possible to be able to access a folder starting from the current directory that you can't access starting from the root directory. If you change your working directory to somewhere else, you will loose your handle on the current directory and loose access to the files in it. If you use something like sudo su - ircuser, su will switch to the home directory of ircuser before dropping root privileges. At that point, you have a valid handle for ircuser's home directory because it's the current working directory. If you start irssi, it will be running in ircuser's home directory as ircuser. If you try to access .irssi, that will work because you have eXecute permission on the current direcory. If you have to traverse a directory where you are lacking eXecute permission, iy will fail. For example, opening up the file /home/myuser/_web/ircuser/.irssi or even starting from the current directory and using the relative path of ../../_web/ircuser/.irssi because it requires traversing /home/myuser where you have no eXecute permission.

Answer 2

Use the -H option which makes the command executed with sudo to consider 'home' the user's home directory. You can find more detailed explanation on sudo's man page: http://linux.die.net/man/8/sudo

Answer 3

Would you mind trying with sudo -iu ircuser /usr/bin/irssi ?

Additionally, as Patkos Csaba already stated check for the env_reset, env_keep Defaults set in your sudoers.

From the sudoers manpage:

As a special case, if sudo's -i option (initial login) is specified,
sudoers will initialize the environment regardless of the value of
env_reset.  The DISPLAY, PATH and TERM variables remain unchanged;
HOME, MAIL, SHELL, USER, and LOGNAME are set based on the target user.
On Linux and AIX systems the contents of /etc/environment are also
included.  All other environment variables are removed.

So sudo -i will initialize the environment getting around the values of these.

Edit: I've reproduced your setup on a Ubuntu box and even sudo -u ircuser /usr/bin/irssi works fine for me.

From my /etc/sudoers

<snipped>
Defaults    env_reset, log_output
<snipped>
testing LABUBU01=(ircuser) NOPASSWD: /usr/bin/irssi

Versions:

testing@LABUBU01:~$ sudo -V
Sudo version 1.8.3p1
pmplugin policy_plugin 5.6.0 (034)
pmplugin io_plugin 5.6.0 (034)
testing@LABUBU01:~$ uname -a
Linux LABUBU01 2.6.35-28-generic #50-Ubuntu SMP Fri Mar 18 19:00:26 UTC 2011 i686 GNU/Linux


testing@LABUBU01:~$ ls -lap /home/
total 64
drwxr-xr-x 16 root     root     4096 2012-03-02 15:57 ./
drwxr-xr-x 22 root     root     4096 2011-12-08 15:48 ../
drwxr-xr-x  3 ircuser  ircuser  4096 2012-03-02 15:57 ircuser/

/EDIT

EDIT2:

your error:

** ERROR **: Couldn't create /home/myuser/_web/ircuser/.irssi directory aborting... Aborted

states, it cannot create /home/myuser/_web/ircuser/.irssi which is in your home, not in ircuser's home directory. /EDIT2