Lockdown find command in sudoers with regex

Question

I want to allow a service user to search for files via a dialog script, but lock down the find command via sudoers, so only one command including a regex is allowed.

This exact command should be allowed in the sudoers, and nothing else (i'm especially afraid of the -delete and -exec functionality of find)

operator ALL=NOPASSWD:/bin/find / -type f -regex ".*/core.[0-9]*$"

But it looks like the sudoers glob messes with the regex pattern. I already tried to escape the regex pattern, but sudo always asks me for a password.

Moving the whole "lockdown" into the script and allowing sudo to run the script with write access only, for the root user, is not an option, because we update this dialog script via a SVN routine, which will complicate the deployment process.

Answer 1

You use your regex as a flag parameter for find, so there should be no problem there, even though sudoers does not support regular expressions, only shell wildcard-like globbing (see man page). So what you are trying seems conceptually sound.

At least for GNU bash 4.x and later the -regex default patterns' syntax is the EMACS regex syntax. There may be subtle differences (which I'd have to research to know) with, say, things you might be better acquainted with, such as sed, awk, or grep utilities regex' syntaxes...
If you are on RHEL, check your doc carefully on that, as things may be slightly different...
In any case you can always specify, for instance:

 operator ALL=NOPASSWD: /usr/bin/find -type f -regextype grep -regex ".*core\.[0-9]*$"

... means any regular file from the current directory down, which starts with one or more of any characters, followed by the string "core.", ending with one or more digits.
Again, is that what you want ?
If not, state in plain English what you want your regex to do, or just give a few significant examples of what you want to catch, so I may translate that to a proper GNU flavored grep-style regex.

A word of caution:

• To use the same sudoers rule on various platforms I would recommend you systematically specify the type of regex syntax you mean to apply, as shown above.
• In the context of sudoers, I would always specify the path down which you want to execute your search. Use the -path flag followed by the absolute path of top most level of the sub-tree you want to search.

=====================

All said, for readability and safety reasons when dealing with sudoers, I generally recommend writing a minimal wrapper script for your find cmd, e.g. called findcore.sh, owned by root:root, with permissions 751, which accepts no parameters (via the use of "").

operator ALL=NOPASSWD: /path/to/findcore.sh ""

You can then easily update the content of the script via SVN or another mechanism without sudo password, by including a second rule in your sudoers file, specifically for updates performed via your favorite mechanism.

HTH