I might be stating the obvious, but I think the answer is in the config.
You've mentioned your config shows
(root) NOPASSWD: /bin/su - someuser
So you are permissioned to run only one command ie /bin/su - someuser
as root (so this avoids su prompting for a password) and the NOPASSWD: means sudo will not ask you for a password to do it.
But you want to run other commands as someuser, (directly from your own shell) sudo -u someuser somescript
But that's not configured.
You want, sudo -l
to show something along the lines of
(root) NOPASSWD: /bin/su - someuser
(someuser) NOPASSWD: /bin/ls, /usr/bin/whoami, /home/someuser/bin/ascript
(above output may not be 100% as it will be displayed but hope you can understand what I mean)
The way you are configured at the moment, means you must first su to someuser and then run commands as that user.
It sounds like you don't have admin control over this machine. Maybe develop the script as the someuser, then you'll have a list of commands and a script tested, to got back to your admin, to add to /etc/sudoers
.
sudo su - someuser
assomeuser
? That should prompt for thesudo
password, as well as the others. In my computer it does. It's Linux though.sudo
password. What do you mean then?