1

Redhat Enterprise Linux 5.10 (No we can't upgrade, please don't ask.)

I have a user, 'tina' who is logged into the system. I need her and user 'lu' to use chmod, chgrp, and chown commands for certain reasons (no they don't know enough to be a security risk, we have daily backups anyway). At first I used sudo nedit /etc/sudoers to edit the file. Whereon I added this line:

tina,lu ALL=/bin/chmod /bin/chown /bin/chgrp

Then I found I have to use the visudo command, which I did, and I saved the file without edits.

So I went to test her use of chgrp and I got an error like "Does not have permission to use this command".

  • If I change sudoers do the users need to log off unix shell windows and logon again? The man pages didn't say nor did any pages on Google.
  • Do I have to restart the server?
  • 2
    No you don't need to restart anything. It might be the syntax of your sudo rule, but can you post the full sudo command you're running to test? It's also worth noting that giving a user chown effectively gives them unrestricted root on the machine. They have to know how to exploit it, but it's not exceptionally difficult to do that. You might make your sudo command spec more specific so that they can only do certain directories. – Bratchley May 9 '16 at 13:09
  • 2
    Commas are missing in you configuration. It should be : tina,lu ALL=/bin/chmod,/bin/chown,/bin/chgrp. Although it's probably not the right thing to do anyway. – user60039 May 9 '16 at 13:15
  • sudoers is consulted each time, so as long as your syntax is correct, it will work without logout/login (unless the user needs to be in a newly-created group for the rule) – Jeff Schaller May 9 '16 at 14:55
  • @Bratchley it's hard to restrict a sudo command to part of the filesystem without resorting to something like a script that front-ends chown – roaima May 9 '16 at 15:13
  • 1
    @roaima Fair enough given .. but the point still stands that this is probably not what they want to do because it's not exceptionally difficult to exploit this. – Bratchley May 9 '16 at 15:37
1

tina needs to write sudo chgrp .... Otherwise, the the sudoers is not considered.

  • I think this answer addresses one possible failure scenario (tina not typing 'sudo' before chgrp -- it wasn't made explicit what tina actually typed), but it does not address the (logical) sudoers syntax "error" listed in the Q that fails to give chgrp access to tina, nor the two explicit questions in the Q about logging off & on and restarting the server. – Jeff Schaller May 9 '16 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.