1

The General Case

I'm trying to enable a user to run a sudo command (with arguments) without a password. I can get the NOPASSWD directive to work, but only when the arguments don't contain quotation marks.

For example, this works:

# /etc/sudoers.d/sample
%sudo   ALL=(ALL)  NOPASSWD: /bin/echo foo

$ sudo echo foo
foo

But this doesn't, because quotation marks are interpreted literally:

# /etc/sudoers.d/sample
%sudo   ALL=(ALL)  NOPASSWD: /bin/echo "foo"

$ sudo echo "foo"
[sudo] password for rlue:
$ sudo echo \"foo\"
"foo"

My Specific Case

This is the command I'm trying to allow:

$ sudo sh -c 'echo XHCI > /proc/acpi/wakeup'

I actually got it to work with the following unquoted command:

%sudo   ALL=(ALL)  NOPASSWD: /bin/sh -c echo XHCI > /proc/acpi/wakeup

But since it calls out to sh -c, and since I clearly don't understand precisely what's going on, I'd like to be extra explicit about what I'm allowing.

How can I specify quoting for command arguments in the sudoers file?

  • The sudoers man page says "If a Cmnd has associated command line arguments, then the arguments ... must match exactly those given by the user...", so you're already being "extra explicit" about what you're allowing. – dsstorefile1 May 9 '18 at 3:16
  • Sure, but for example, mv this that the other is different from mv this that 'the other', and the unquoted syntax permits both. How can I be sure I haven't missed any edge cases? – Ryan Lue May 9 '18 at 3:32
  • 1
    If you're worried about edge cases, see serverfault.com/a/516002. Apparently, that is the "simple solution". – dsstorefile1 May 9 '18 at 3:41
0

edit: Warning, it appears that sudo does not safely handle spaces in the command, so it is not safe to use sudo in this way. https://unix.stackexchange.com/a/279142/39281

Instead of using quotes in the sudoers file, you can escape spaces using backslash:

%sudo   ALL=(ALL)  NOPASSWD: /bin/sh -c echo\ XHCI\ >\ /proc/acpi/wakeup

You can still use it as follows, because the user's shell handles the quoted argument anyway:

sudo /bin/sh -c 'echo XHCI > /proc/acpi/wakeup'

You could also consider putting a complex command into a script, as suggested in a comment. https://serverfault.com/a/516002

  • This appears semantically identical to not having backslashes (that is, the arguments can still be grouped with quotation marks in every possible arrangement). – Ryan Lue May 9 '18 at 7:03
  • Someone commented: there's an other QA telling this is possibly unsafe: unix.stackexchange.com/questions/279125/… then removed their comment. But they were right, it is unsafe, seems like sudo is not safe to be used when there are spaces in the command name. Perhaps I am misusing it, or perhaps it is a rubbish insecure tool. If it is so easy to misuse, I suggest the latter. – Sam Watkins May 9 '18 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.