1

Redhat Enterprise Linux 5.10 (No we can't upgrade, please don't ask.)

I have a user, 'tina' who is logged into the system. I need her and user 'lu' to use chmod, chgrp, and chown commands for certain reasons (no they don't know enough to be a security risk, we have daily backups anyway). At first I used sudo nedit /etc/sudoers to edit the file. Whereon I added this line: 

tina,lu ALL=/bin/chmod /bin/chown /bin/chgrp

Then I found I have to use the visudo command, which I did, and I saved the file without edits.

So I went to test her use of chgrp and I got an error like "Does not have permission to use this command".

  • If I change sudoers do the users need to log off unix shell windows and logon again? The man pages didn't say nor did any pages on Google.
  • Do I have to restart the server?
6
  • 2
    No you don't need to restart anything. It might be the syntax of your sudo rule, but can you post the full sudo command you're running to test? It's also worth noting that giving a user chown effectively gives them unrestricted root on the machine. They have to know how to exploit it, but it's not exceptionally difficult to do that. You might make your sudo command spec more specific so that they can only do certain directories.
    – Bratchley
    May 9, 2016 at 13:09
  • 2
    Commas are missing in you configuration. It should be : tina,lu ALL=/bin/chmod,/bin/chown,/bin/chgrp. Although it's probably not the right thing to do anyway.
    – user60039
    May 9, 2016 at 13:15
  • sudoers is consulted each time, so as long as your syntax is correct, it will work without logout/login (unless the user needs to be in a newly-created group for the rule)
    – Jeff Schaller ♦
    May 9, 2016 at 14:55
  • @Bratchley it's hard to restrict a sudo command to part of the filesystem without resorting to something like a script that front-ends chown
    – Chris Davies
    May 9, 2016 at 15:13
  • 1
    @roaima Fair enough given .. but the point still stands that this is probably not what they want to do because it's not exceptionally difficult to exploit this.
    – Bratchley
    May 9, 2016 at 15:37

1 Answer 1

Reset to default
1

tina needs to write sudo chgrp .... Otherwise, the the sudoers is not considered.

1
  • I think this answer addresses one possible failure scenario (tina not typing 'sudo' before chgrp -- it wasn't made explicit what tina actually typed), but it does not address the (logical) sudoers syntax "error" listed in the Q that fails to give chgrp access to tina, nor the two explicit questions in the Q about logging off & on and restarting the server.
    – Jeff Schaller ♦
    May 9, 2016 at 15:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .