When running the script
sudo -u otheruser ./bla
I get an output indicating that this script is run such that no external commands are available:
otheruser ./bla: line 3: /bin/sleep: Permission denied ./bla: line 4: /bin/sleep: Permission denied
The script itself is simple:
#!/bin/bash echo $USER /bin/sleep 1 sleep 1
The last error message even seems to indicate that it is not really a bash that is running but rather a shell that does not have sleep as a built in command, since otherwise it would not complain about
Reading the docs, I find NOEXEC, which would possibly fit the bill, but /etc/sudoers has not hint on NOEXEC.
Am I on the right track with NOEXEC? If yes, why could it be active if it is not in
sudo -V also has no hint towards it?
EDIT: as asked in the comments, the output of
sudo -l -l:
Matching Defaults entries for xxxxx on this host: always_set_home, env_reset, env_keep="LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS XDG_SESSION_COOKIE", targetpw, !authenticate, noexec, syslog=local5, env_reset, always_set_home User xxxxx may run the following commands on this host: Sudoers entry: RunAsUsers: ALL Commands: ALL LDAP Role: CENSORED RunAsUsers: root Options: !noexec Commands: /bin/su - solr LDAP Role: T-SOLRSEARCH RunAsUsers: root Options: !noexec Commands: ALL
Ok, here we have a
!noexec. What's the deal with the '!'?