What I want is:

  • to be able to run /sbin/print/managequeue.sh -p app1 --view as another user without asking for a password.
  • to be able to run /sbin/print/managequeue.sh -p app1 --cancel (or --delete, or --pause, etc) as another user, but asking for password.

Preferably, I don't want to create a Cmnd_Alias with all possible arguments. So, I tried the three aliases and the User Specification below:

Host_Alias      PRINTSRVS = printsrv, printsrvbkp
Cmnd_Alias      APP1PMV = /sbin/print/managequeue.sh -p app1 --view
Cmnd_Alias      APP1PMD = /sbin/print/managequeue.sh -p app1 *, !APP1PMV

%app1adms, %helpdesk PRINTSRVS = (printop2:printop2) NOPASSWD: APP1PMV, \
                                 (printop2:printop2) PASSWD: APP1PMD

When I run sudo -u printop2 /sbin/print/managequeue.sh -p app1 --cancel it works:

[sudo] password for app1adm1:
Managing queue...

But when I run sudo -u printop2 /sbin/print/managequeue.sh -p app1 --view it doesn't:

Sorry, user app1adm1 is not allowed to execute '/sbin/print/managequeue.sh -p app1 --view' as printop2 on printsrv.

Apparently my second command (printop2:printop2) PASSWD: APP1PMD overrode my first command (printop2:printop2) NOPASSWD: APP1PMV and denied the --view argument altogether.

Would you please explain this issue?

  • I can't test right now, but I believe order matters and sudo reads bottom-up; try swapping the order of the commands – Jeff Schaller Sep 14 at 17:05
  • 1
    I made some tests and it seems order really matters and it´s top-down. Apparently if two commands are conflicting the one on the bottom is kept. In sudores File format section it says: When multiple entries match for a user, they are applied in order. Where there are multiple matches, the last match is used (which is not necessarily the most specific match). – Adriano_epifas Sep 14 at 18:03
  • Feel free to self-answer! – Jeff Schaller Sep 14 at 18:04
  • if you can post as an answer I flag as answered. You led me to find it. – Adriano_epifas Sep 14 at 18:09
  • In the future, keep in mind U&L policy (and likely other sites’) against cross-posting/ multi-posting. It’s seen as a waste of multiple people’s attention and may result in votes to close one or all of the posts. It’s one of many StackExchange‘s inner workings. Thank you, and welcome to the network! – Jeff Schaller Sep 16 at 14:22
up vote 0 down vote accepted

Based on the sudoers (v1.8.25) description:

When multiple entries match for a user, they are applied in order. Where there are multiple matches, the last match is used (which is not necessarily the most specific match).

... you'll need to swap the order around so that the --view version of the command is listed last.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.