3

This question already has an answer here:

I'm trying to set my local computer (which has Linux Mint 13 Maya) so that I can chmod & chown any file with my regular max user account.

Following this page, https://askubuntu.com/questions/159007/how-do-i-run-specific-sudo-commands-without-a-password

I've done the following:

#edit the /etc/sudoers file via `visudo` 
sudo visudo

#in the file, added these lines:
Cmnd_Alias NOPASS_CMNDS = /bin/chmod, /bin/chown
max ALL=(ALL) NOPASSWD: NOPASS_CMNDS

Then saved. (I got the locations for chmod and chown using which)

So, my visudo file now looks like this:

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

Cmnd_Alias NOPASS_CMNDS = /bin/chmod, /bin/chown
max ALL=(ALL) NOPASSWD: NOPASS_CMNDS

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

This is the output from sudo -l

$ sudo -l
Matching 'Defaults' entries for max on this host:
    env_reset, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User max may run the following commands on this host:
    (ALL) NOPASSWD: /bin/chmod, /bin/chown
    (ALL : ALL) ALL

I then open a new shell tab and try to sudo chmod a file which is owned by a different user & group, and it asks me for a password:

$ ls -l  tmp/0000000001
-rw------- 1 www-data www-data 19245781 Sep 10 16:59 tmp/0000000001

$ sudo chmod +w tmp/0000000001
[sudo] password for max:

Am I missing something here? I don't know if I've done it wrong or have misunderstood what I was actually trying to change.

Do I need to reboot, or reload/restart something to see the change?

marked as duplicate by Gilles, dhag, G-Man, Braiam, muru Sep 17 '15 at 21:43

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

migrated from askubuntu.com Sep 17 '15 at 13:24

This question came from our site for Ubuntu users and developers.

  • And when you do post there, remember to add the output of sudo -l and the lines in sudoers which come after the lines you added. – muru Sep 17 '15 at 13:20
  • Did you save and exit visudo or just save? – terdon Sep 17 '15 at 13:27
  • 1
    What's the output of type -a chmod? – terdon Sep 17 '15 at 14:38
  • 4
    Is max a member of the admin or sudo groups? (I think this is the case because (ALL : ALL) ALL appears in your sudo -l output). The config line for that group may be taking precedence over the NOPASSWD line. – Mark Plotnick Sep 17 '15 at 14:56
  • 2
    The solution is to post the lines with NOPASSWD lower down in the config than the line granting ALL to the admin/wheel/sudo group. – Jenny D Sep 17 '15 at 15:02
4

The issue here is that there are two rules for this user:

(ALL) NOPASSWD: /bin/chmod, /bin/chown
(ALL : ALL) ALL

The second one comes from the line in sudoers reading

%sudo   ALL=(ALL:ALL) ALL

Sudo will use the first matching rule starting from the bottom of the file - so when you need to have different options for a subset of commands, you need to make sure that they are listed below the more generic line.

In other words, you need to make sure that the line

max ALL=(ALL) NOPASSWD: NOPASS_CMNDS

is placed after the line

%sudo   ALL=(ALL:ALL) ALL

in the file.

Not the answer you're looking for? Browse other questions tagged or ask your own question.