Specify command with quoted arguments in sudoers?

Question

The General Case

I'm trying to enable a user to run a sudo command (with arguments) without a password. I can get the NOPASSWD directive to work, but only when the arguments don't contain quotation marks.

For example, this works:

# /etc/sudoers.d/sample
%sudo   ALL=(ALL)  NOPASSWD: /bin/echo foo

$ sudo echo foo
foo

But this doesn't, because quotation marks are interpreted literally:

# /etc/sudoers.d/sample
%sudo   ALL=(ALL)  NOPASSWD: /bin/echo "foo"

$ sudo echo "foo"
[sudo] password for rlue:
$ sudo echo \"foo\"
"foo"

---

My Specific Case

This is the command I'm trying to allow:

$ sudo sh -c 'echo XHCI > /proc/acpi/wakeup'

I actually got it to work with the following unquoted command:

%sudo   ALL=(ALL)  NOPASSWD: /bin/sh -c echo XHCI > /proc/acpi/wakeup

But since it calls out to sh -c, and since I clearly don't understand precisely what's going on, I'd like to be extra explicit about what I'm allowing.

How can I specify quoting for command arguments in the sudoers file?

Answer 1

edit: Warning, it appears that sudo does not safely handle spaces in the command, so it is not safe to use sudo in this way. https://unix.stackexchange.com/a/279142/39281

Instead of using quotes in the sudoers file, you can escape spaces using backslash:

%sudo   ALL=(ALL)  NOPASSWD: /bin/sh -c echo\ XHCI\ >\ /proc/acpi/wakeup

You can still use it as follows, because the user's shell handles the quoted argument anyway:

sudo /bin/sh -c 'echo XHCI > /proc/acpi/wakeup'

You could also consider putting a complex command into a script, as suggested in a comment. https://serverfault.com/a/516002