0

We are using devtoolset-3 on RHEL6.6. Users run scl enable devtoolset-3 bash in order to access an environment with all the devtoolset-3 tools.

I would like to allow users to run a subset of commands as root. The normal way to do this is to use sudo with a sudoers file containing a command alias with a list of commands you want the user to be able to execute as root.

I have tried various combinations but I can't come up with the right recipe.

Below are some of the things I have tried:

Attempt 1:

I create a command alias:

Cmnd_Alias ALLOWEDCOMMANDS=/usr/bin/pkill <process name>

and then allow members of myGroup to execute those commands without a password

%myGroup  ALL=(ALL) NOPASSWD:SETENT: ALLOWEDCOMMANDS

With that setup if I try and run sudo pkill I get:

Sorry, user is not allowed to execute '/usr/bin/scl enable devtoolset-3 'pkill' ''' as root

Attempt 2:

I modified the sudoers file to have the complete command:

Cmnd_Alias ALLOWEDCOMMANDS=/usr/bin/scl enable devtoolset-3 pkill <some_process_name>

but I still get the same error.

Attempt 3:

If I list /usr/bin/scl as an allowed command then the user is allowed to execute any command as root in an scl enabled environment.

Can anyone come up with a reliable way to allow users to run a certain list of commands in a scl enabled shell?

0

Just in case anyone else runs into this problem I thought I'd post the answer that I received from red hat support here.

it turns out that the devtoolset-3 version of sudo doesnt play nicely the format of command alias's you can specify in /etc/sudoers.

In your devtoolset-3 enabled shell you can alias sudo=/usr/bin/sudo. Then your users will run the standard sudo which does handle command aliases correctly.

With that alias in place everything works as expected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.