1

I want to allow user to check how many rules are present in filter table, but not able to view actual rules, is that possible?

literally I mean iptables -L | wc -l (I know it's faulty), but sudo doesn't seem to support pipe commands like that, I mean, currently If I wanted to allow that, I need to grant permission to run iptables -L instead of iptables -L | wc -l

Any thoughts?

  • not sure what shell you are using but I'am able to run the following: sudo iptables -L|egrep -v 'Chain|target'|wc -l without any problem – BitsOfNix Jan 2 '13 at 13:48
  • @AlexandreAlves updated question ... – daisy Jan 2 '13 at 13:54
  • The reason that pipe commands do not work with sudo, is because it is actually two separate commands... – Gert van den Berg Jan 2 '13 at 14:06
4

Create a script that runs the commands to get the number of iptables rules. I would suggest something like this:

#!/bin/sh
/sbin/iptables -L | grep -Ecv '^$|^Chain |^target'

Save script in /usr/local/bin, make it executable and check that only root can write to it. Recommended mode: 0555

Edit sudoers to allow the user to run that script using sudo.

  • Looks easy to do that! But anyway, I modified iptables program to do the counting ... thanks anyway, scripting is a good ideas to problems like this – daisy Jan 2 '13 at 15:04
  • (This is not completely valid with the edited case where the user doesn't have permissions to run iptables -L) (the info seem to require root to access, so a modified iptables (or other command getting the info from /proc/net/ip_*) running setuid root or via sudo is likely the only practical solution) – Gert van den Berg Mar 23 '16 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.