Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 0 down vote favorite

My /etc/sudoers file has following entries:-

## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
agupta ALL= /sbin/,/usr/sbin/,/bin/,/bin/cat /etc/sudoers
ADMINS ALL= !/usr/bin/su, !SHELLS
alice ALL =(%Children) /sbin/, /usr/sbin/, /bin/

alice is a member of the Children group; please find below are details for alice:-

[alice@localhost ~]$ id alice
uid=1005(alice) gid=1004(Children) groups=1004(Children)

When I try to run this command /bin/cat /etc/sudoers i get following errors:-

[alice@localhost ~]$ sudo  cat /etc/sudoers
Sorry, user alice is not allowed to execute '/bin/cat /etc/sudoers' as root on localhost.localdomain.

In /var/log/secure, I can see the following entries being populated:- 

Mar 21 06:40:40 localhost sudo:    alice : command not allowed ; TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/bin/cat /etc/sudoers

Any suggestions on this?

----------EIDT -1 Modified the file by removing the impersonation from the file i.e.

alice ALL = /sbin/, /usr/sbin/, /bin/

I was able to run the command sudo cat /etc/sudoers . I want to try out masquerading: but I am not able to make it work on my system

----------EDIT-2

## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
agupta,myself    ALL=(wheel)  ALL
jane ALL=(%parents) ALL

Command I ran:- 

[jane@localhost ~]$ sudo -u paul cat /etc/sudoers
[sudo] password for jane:
cat: /etc/sudoers: Permission denied

Logs in /etc/log/secure:-

Mar 15 15:26:24 localhost sudo:     jane : TTY=pts/2 ; PWD=/home/jane ; USER=paul ; COMMAND=/bin/cat /etc/sudoers

Members of the group parents:-

[root@localhost ~]# id jane
uid=505(jane) gid=504(parents) groups=504(parents)
[root@localhost ~]# id paul
uid=504(paul) gid=504(parents) groups=504(parents)

Am, I still making any silly mistake?

share|improve this question
I don't know the sudoers syntax in detail, but I think you'll normally want to specify either a user name or a group, instead of both. – l0b0 Mar 21 at 9:21
What do you mean by masquerading? What are you trying to do? – Gilles Mar 21 at 22:36
by masquerading, I mean to run a command as another user/group. – Ankit Mar 22 at 18:44
@gilles; I am trying to run a command as a different user. – Ankit Mar 23 at 10:38

1 Answer

up vote 3 down vote accepted

The to use the impersonating features of sudo (it defaults to user root) you need to use the -u option like this:

sudo -u agupta ls ~agupta

In addition, if agupta is in the Children group, to do that you need to run sudo under sudo:

sudo -u agupta sudo cat /etc/sudoers
share|improve this answer
i am not able to use masquerading feature at all. Should both the users belong to the same group? – Ankit Mar 21 at 16:56
Masquerading is done using the -u switch in sudo, the user doing the masquerading should have permissions to run the command in question as the user you want it to masquerade. In your case alice should be able to run the binaries in /sbin /usr/bin and /bin as any member of the Children group, but the member of the children group must be mentioned with the -u switch. – David Kohen Mar 23 at 9:46
+1, thanks for the explanation David. I am using "u" switch with sudo to run the command but I am getting permission denied error. I have edited my question to include the changes. – Ankit Mar 23 at 10:32
:o, I forgot to use second sudo and to add other user from the same group to visudo. Making the necessary changes solved the problem. So here are the log entries in /var/log/secure:- Mar 15 15:42:33 localhost sudo: jane : TTY=pts/2 ; PWD=/home/jane ; USER=paul ; COMMAND=/usr/bin/sudo cat /etc/sudoers Mar 15 15:42:33 localhost sudo: paul : TTY=pts/2 ; PWD=/home/jane ; USER=root ; COMMAND=/bin/cat /etc/sudoers – Ankit Mar 23 at 10:47
So if the problem is solved, mark the question as answered. – David Kohen Mar 23 at 14:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.