The General Case

I'm trying to enable a user to run a sudo command (with arguments) without a password. I can get the NOPASSWD directive to work, but only when the arguments don't contain quotation marks.

For example, this works:

# /etc/sudoers.d/sample
%sudo   ALL=(ALL)  NOPASSWD: /bin/echo foo

$ sudo echo foo

But this doesn't, because quotation marks are interpreted literally:

# /etc/sudoers.d/sample
%sudo   ALL=(ALL)  NOPASSWD: /bin/echo "foo"

$ sudo echo "foo"
[sudo] password for rlue:
$ sudo echo \"foo\"

My Specific Case

This is the command I'm trying to allow:

$ sudo sh -c 'echo XHCI > /proc/acpi/wakeup'

I actually got it to work with the following unquoted command:

%sudo   ALL=(ALL)  NOPASSWD: /bin/sh -c echo XHCI > /proc/acpi/wakeup

But since it calls out to sh -c, and since I clearly don't understand precisely what's going on, I'd like to be extra explicit about what I'm allowing.

How can I specify quoting for command arguments in the sudoers file?

  • Sure, but for example, mv this that the other is different from mv this that 'the other', and the unquoted syntax permits both. How can I be sure I haven't missed any edge cases?
    – Ryan Lue
    May 9, 2018 at 3:32

1 Answer 1


edit: Warning, it appears that sudo does not safely handle spaces in the command, so it is not safe to use sudo in this way. https://unix.stackexchange.com/a/279142/39281

Instead of using quotes in the sudoers file, you can escape spaces using backslash:

%sudo   ALL=(ALL)  NOPASSWD: /bin/sh -c echo\ XHCI\ >\ /proc/acpi/wakeup

You can still use it as follows, because the user's shell handles the quoted argument anyway:

sudo /bin/sh -c 'echo XHCI > /proc/acpi/wakeup'

You could also consider putting a complex command into a script, as suggested in a comment. https://serverfault.com/a/516002

  • This appears semantically identical to not having backslashes (that is, the arguments can still be grouped with quotation marks in every possible arrangement).
    – Ryan Lue
    May 9, 2018 at 7:03
  • Someone commented: there's an other QA telling this is possibly unsafe: unix.stackexchange.com/questions/279125/… then removed their comment. But they were right, it is unsafe, seems like sudo is not safe to be used when there are spaces in the command name. Perhaps I am misusing it, or perhaps it is a rubbish insecure tool. If it is so easy to misuse, I suggest the latter. May 9, 2018 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.