2

Here is a script:

#!/bin/bash

user='my_sudo_user'
sudo -lU $user

I was trying to limit my non_sudo_user to have the ability to run this script. Using visudo, I tried:

non_sudo_user ALL=(ALL) NOPASSWD: /bin/bash /full/path/script.sh
non_sudo_user ALL=(ALL) NOPASSWD: /usr/bin/sudo -lU
non_sudo_user ALL=(ALL) NOPASSWD: /usr/bin/sudo -lU *   # unsafe

None of them work. I get this message:

Sorry, user non_sudo_user is not allowed to execute 'list' as my_sudo_user on host123.

But I provided -l in sudoer file.

What can I do? This is Ubuntu by the way.

EDIT:

I actually run this script:

for u in $(awk -F'[/:]' '{if($3>=1000&&$3!=65534) print $1}' /etc/passwd); do sudo -lU $u ; done

So I don't have a definite list of users ahead of time.

0

EDIT: complete rewrite after OP provided more information.

Specify the user in /etc/sudoers as having permission to execute /usr/sbin/sudo.

This will allow them to execute the sudo command, but they will have no permissions to run any other commands.

I just tested this on CentOS-7.3.1611 with a brand new user account:

testusr ALL=(ALL) NOPASSWD: /usr/sbin/sudo

I do not know if there are any security implications of specifying the sudo command itself in the list of allowed commands Please review and test before you rely on this in a production environment...it may be insecure.

  • Thanks, but it still complain it doesn't have permission to execute 'list'. – CppLearner Apr 20 '17 at 17:35
  • Okay, so I guess I don't understand why you would use sudo to run a script that invokes sudo to list the users commands. Just tell the user to execute sudo -l for their own commands or sudo -lU someuser to list the commands someuser is allowed to run. – 0xSheepdog Apr 20 '17 at 17:44
  • 1
    I am trying to run a report as the non_sudo_user to test whether "my_sudo_user" has sudo privilege or not. The best reliable way is to run sudo -lU as far as I know. The reason the non_sudo_user can't have full privilege because it is meant for read-only. – CppLearner Apr 20 '17 at 18:04
  • thank you, the /usr/sbin/sudo will allow my non sudo user to have full sudo privilege. It's okay, I might have to work around with this for now, but I am hoping someone could come up with a solution, but I appreciate your help! – CppLearner Apr 20 '17 at 18:34
  • Hmm, did you test what happens if testuser runs: sudo sudo -s? I suspect that results in a root shell. – derobert Apr 20 '17 at 18:53
0

I think you can only list the commands a different user can run if you can run arbitrary commands as (ALL) that user. So instead...

In sudoers:

non_sudo_user ALL=(ALL) NOPASSWD: /usr/bin/sudo -l

And to list them, running as non_sudo_user:

for target_user in user1 user2 user3... ; do
    sudo -u "$target_user" sudo -l
done
  • this works, but using -u I am stuck on users who aren't sudoer as I am asked for password. That's the expected behavior, but not quite what I am looking for. It was the reason i went with -lU (U goes with the list option). – CppLearner Apr 20 '17 at 18:27
  • @CppLearner I think (haven't tested) you could change the sudoer rule to allow ALL instead of non_sudo_user, if I'm understanding you correctly. Though you probably shouldn't... (Or maybe change my_sudo_user to ALL, not exactly sure what you're going for) – derobert Apr 20 '17 at 18:50
  • @CppLearner oh! I see you edited your question—I've updated the answer. This should do what you want. – derobert Apr 20 '17 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.