1

When running the script bla with

sudo -u otheruser ./bla

I get an output indicating that this script is run such that no external commands are available:

otheruser
./bla: line 3: /bin/sleep: Permission denied
./bla: line 4: /bin/sleep: Permission denied

The script itself is simple:

#!/bin/bash
echo $USER
/bin/sleep 1
sleep 1

The last error message even seems to indicate that it is not really a bash that is running but rather a shell that does not have sleep as a built in command, since otherwise it would not complain about /bin/sleep.

Reading the docs, I find NOEXEC, which would possibly fit the bill, but /etc/sudoers has not hint on NOEXEC.

Am I on the right track with NOEXEC? If yes, why could it be active if it is not in /etc/sudoers and sudo -V also has no hint towards it?

EDIT: as asked in the comments, the output of sudo -l -l:

Matching Defaults entries for xxxxx on this host:
    always_set_home, env_reset, env_keep="LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS XDG_SESSION_COOKIE", targetpw, !authenticate, noexec, syslog=local5, env_reset,
    always_set_home

User xxxxx may run the following commands on this host:

Sudoers entry:
    RunAsUsers: ALL
    Commands:
ALL

LDAP Role: CENSORED
    RunAsUsers: root
    Options: !noexec
    Commands:
/bin/su - solr

LDAP Role: T-SOLRSEARCH
    RunAsUsers: root
    Options: !noexec
    Commands:
ALL

Ok, here we have a !noexec. What's the deal with the '!'?

  • Can you edit your question and include the output of sudo -l -l (yes, that's -l (lower case L) twice, -ll works too). – EightBitTony May 27 '16 at 13:36
  • Output of ls -l /bin/sleep ? – Jeff Schaller May 27 '16 at 17:00
  • Currently I have no access to the machine to list /bin/sleep, but we replaced sudo with su and then it works, so access rights should be no problem. – Harald May 29 '16 at 10:19
1
Matching Defaults entries for xxxxx on this host:
    …, noexec, …

The user xxxxx is allowed to run any program, but this program isn't allowed to run any other program. There are exceptions when running commands as root. As a security restriction, this makes no sense: if you can run any program then you can e.g. run passwd and change the password on the root account; if you can run programs as root then you can run programs as any user. So this is a misconfiguration.

Look for a Defaults line in /etc/sudoers or in files under /etc/sudoers.d containing the noexec option.

In !noexec, ! is a negation: this disables the noexec option.

  • This negation makes it even stranger then, because the user should then be able to run /bin/sleep from a shell script. But he can't. Hmm, strange. – Harald May 29 '16 at 10:17
  • @Harald The negation is only in rules where the target user is root, so it doesn't apply here since the target user is otheruser. – Gilles May 29 '16 at 10:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.