I'm trying to set my local computer (which has Linux Mint 13 Maya) so that I can chmod & chown any file with my regular max user account.

Following this page, https://askubuntu.com/questions/159007/how-do-i-run-specific-sudo-commands-without-a-password

I've done the following:

#edit the /etc/sudoers file via `visudo` 
sudo visudo

#in the file, added these lines:
Cmnd_Alias NOPASS_CMNDS = /bin/chmod, /bin/chown

Then saved. (I got the locations for chmod and chown using which)

So, my visudo file now looks like this:

# This file MUST be edited with the 'visudo' command as root.
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
# See the man page for details on how to write a sudoers file.
Defaults        env_reset
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

Cmnd_Alias NOPASS_CMNDS = /bin/chmod, /bin/chown

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

This is the output from sudo -l

$ sudo -l
Matching 'Defaults' entries for max on this host:
    env_reset, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User max may run the following commands on this host:
    (ALL) NOPASSWD: /bin/chmod, /bin/chown
    (ALL : ALL) ALL

I then open a new shell tab and try to sudo chmod a file which is owned by a different user & group, and it asks me for a password:

$ ls -l  tmp/0000000001
-rw------- 1 www-data www-data 19245781 Sep 10 16:59 tmp/0000000001

$ sudo chmod +w tmp/0000000001
[sudo] password for max:

Am I missing something here? I don't know if I've done it wrong or have misunderstood what I was actually trying to change.

Do I need to reboot, or reload/restart something to see the change?

  • And when you do post there, remember to add the output of sudo -l and the lines in sudoers which come after the lines you added. – muru Sep 17 '15 at 13:20
  • Did you save and exit visudo or just save? – terdon Sep 17 '15 at 13:27
  • 1
    What's the output of type -a chmod? – terdon Sep 17 '15 at 14:38
  • 4
    Is max a member of the admin or sudo groups? (I think this is the case because (ALL : ALL) ALL appears in your sudo -l output). The config line for that group may be taking precedence over the NOPASSWD line. – Mark Plotnick Sep 17 '15 at 14:56
  • 2
    The solution is to post the lines with NOPASSWD lower down in the config than the line granting ALL to the admin/wheel/sudo group. – Jenny D Sep 17 '15 at 15:02

The issue here is that there are two rules for this user:

(ALL) NOPASSWD: /bin/chmod, /bin/chown

The second one comes from the line in sudoers reading

%sudo   ALL=(ALL:ALL) ALL

Sudo will use the first matching rule starting from the bottom of the file - so when you need to have different options for a subset of commands, you need to make sure that they are listed below the more generic line.

In other words, you need to make sure that the line


is placed after the line

%sudo   ALL=(ALL:ALL) ALL

in the file.

Not the answer you're looking for? Browse other questions tagged or ask your own question.