2

I need to allow a certain user access to these commands:

sudo sync
echo 3 | sudo tee /proc/sys/vm/drop_caches

(This particular developer is doing some DB performance testing and flushing the fs cache gives them cleaner numbers, so please refrain from comments on why we're using this command.)

Can I restrict the user to a very specific command with sudo, e.g. tee /proc/sys/vm/drop_caches?

From what I understand, I can only restrict them to the command tee itself. I don't want to allow the user to be able to use tee as root on anything they want, however.

I guess the other option is to give them write access to that particular file, but is that crazy talk, i.e. giving some non-admin write access to a file in /proc?

Any pointers or ideas on the best way to restrict this are appreciated.

|improve this question
3

Sudo accepts command line arguments. So, you can very well go ahead and make changes to sudoers file such that tee is allowed when the argument is /proc/sys/vm/drop_caches for everything else, sudo will deny execution. If you want a tighter execution, drop in a neat and tidy shell script replacement under somewhere in /usr/bin or /usr/local/bin with tighter permissions and then in sudoers configuration, allow users to execute the script as root on that particular host.

|improve this answer
  • Awesome, glad to hear. Every example I've come across only shows one specific command without arguments. Do you have an example of the syntax for the sudoers file? – Banjer Dec 8 '11 at 20:05
  • I would be inclined to better go for a shell script, even if it could be only minimal lines. This way, you will be for sure aware that you have restricted users to only one shell script to run as root on a particular host and shell script does not do anything apart from just clearing the cache under sudo environment, no argument parsing no muckup with external resources. – Nikhil Mulley Dec 8 '11 at 20:09
  • though man sudoers is sufficient; an online read may give you a quick start linuxhomenetworking.com/wiki/index.php/… – Nikhil Mulley Dec 8 '11 at 20:09
  • If you are going for putting tee into sudoers file directly, then use the fullpath of the tee command. – Nikhil Mulley Dec 8 '11 at 20:19
  • I put the commands into a shell script and dropped that into /usr/bin with appropriate permissions, then restricted the user to only /usr/bin/thescript. Thanks for the help. – Banjer Dec 8 '11 at 21:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.