3

I have a program that reads and writes packets to/from network interfaces, and normally I would add myself in the sudoers file and run the program like this:

sudo ./bridge

But now I need multiple users to run this program, but without giving them sudo rights, such that they could run the program like this:

./bridge

Does anyone know how can I accomplish this? I am running Scientific Linux 6.1 on a 64bit platform.

3 Answers 3

3

You can restrict in sudoers the commands that are allowed to run with sudo.

Write a small script ./bridge that call sudo ./real-bridge and give the users the right to run ./real-bridge as root via sudo.

2
  • As I mentioned in my question, I don't want to give the users sudo rights; this would mess up some things in the program which are based on the $USER enviroment variable, not to mention I give them unlimited rights in the system :)
    – Claudiu
    Commented Feb 20, 2012 at 12:56
  • 3
    @Claudiu I just wanted to get sure, that you know that you can limit the commands which can be run by sudo. If the allowed commands have no security issues, you would not provide unlimited rights to the users.
    – jofel
    Commented Feb 20, 2012 at 13:06
2

I'm not sure if it works with eth devices, but this people do with tun devices.

$ tail -n1 /etc/udev/rules.d/20-kvm.rules 
KERNEL=="tun",          NAME="net/%k", GROUP="mygoodusers", MODE="0660"

See - GROUP="mygoodusers", MODE="0660" - on that line. Of course you have to put each user into that group.

udevadm control --reload-rules

but until reboot you have to chmod/chown manually.

3
  • So, I guess I should put "eth" instead of "tun"? And "eth0"/"eth1"/"eth2" instead of "net/%k"?
    – Claudiu
    Commented Feb 20, 2012 at 12:53
  • but until reboot you have to chmod/chown manually. By the way, what are the files on which I should chown/chmod?
    – Claudiu
    Commented Feb 20, 2012 at 13:06
  • The example with tun device doesn't work with real network adapters. Use sudo for your problem, you can define command alias and group alias as well in /etc/sudoers, plus you will get logging for each usages of sudo ;)
    – jirib
    Commented Feb 20, 2012 at 15:57
1

Add a sudo rule to allow that user to run your script. Run visudo and add something like this to the sudoers file:

Defaults!/path/to/bridge env_reset
alice, bill  ALL = (root) /path/to/bridge

Note that his allows the users to pass any argument to the /path/to/bridge program. Add "" at the end of the line to forbid passing any arguments.

For easier user management, you may prefer to define a group of users who are allowed to control the bridge. Replace alice, bill by %bridgers where bridgers is the name of the group.

Inside the bridge program, $SUDO_UID is the user ID of the user who invoked sudo. If the program requires that user to be in the USER variable, write a small wrapper shell script that sets USER=$SUDO_UID.

1
  • Thanks, I needed something like $SUDO_USER to get the username of the person that used sudo to start the program.
    – Claudiu
    Commented Feb 21, 2012 at 7:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .