5

I'd like 2 users, 'tina' and 'lu' to execute a few utils like /bin/chmod. Here's the relevant portion of my /etc/sudoers file.

tina,lu ALL=/bin/chmod /bin/chown /bin/chgrp

Then I logged in as myself, and then logged in as tina using

su - tina 

Then I tried to get the tina username to do chmod on a file. tina's permissions don't seem to be working. Here's the output of sudo -l -U tina

Matching Defaults entries for tina on this host:
    requiretty, !visiblepw, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC
    KDEDIR LS_COLORS MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE LC_COLLATE
    LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER
    LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

Runas and Command-specific defaults for tina:


User tina may run the following commands on this host:
    (root) /bin/chmod /bin/chown /bin/chgrp

And when I actually try to do a chmod logged in as her. copyf is a new shell script I'm working on.

tina 118->chmod 770 copyf
chmod: changing permissions of `copyf': Operation not permitted
tina 119->sudo chmod 770 copyf
Sorry, user tina is not allowed to execute '/bin/chmod 770 copyf' as root on xpp.

Did I forget to set something up?

  • You're aware that the combination of chmod and chown has given away the keys to the castle? Tina can create a file, change its ownership to root, and then fix the permissions so it's setuid root. Bingo. – roaima Apr 30 '18 at 17:53
9

You are missing the commas:

tina,lu ALL = /bin/chmod, /bin/chown, /bin/chgrp

Without the commas you are giving the right to execute

/bin/chmod /bin/chown /bin/chgrp

which of course doesn't make sense, but is syntactically valid as far as visudo knows.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.