2

I would like to add a command that use echo to write to files into sudoers so that it can be run without a password.

Typically the command would go like this:

sudo sh -c 'echo 1 > /sys/devices/system/cpu/intel_pstate/no_turbo'

(The sh -c is there because running echo directly on sudo just returns permission denied)

And typically to make a command runnable by sudo without password for a user it would be done by adding this to the sudoers file:

cestarian ALL = NOPASSWD: /bin/sh

However I naturally do not want sh to be executable without a password as that would be quite exploitable I imagine, I just want this specific command to work however...

cestarian ALL = NOPASSWD: /bin/sh -c 'echo 1 > /sys/devices/system/cpu/intel_pstate/no_turbo'

This does not work, I know sudoers is supposed to be able to accept commands with specific arguments, but in this case it doesn't work and I do not know why.

I'd like a way to make it work though.

1
  • @Quasimodo that's a nice alternative, I'm a bit torn between this and larsks' answer but i think i'll probably go with larsks solution of making a script for it.
    – Cestarian
    Aug 6, 2022 at 18:31

3 Answers 3

3

sudo does not treat ' and " specially when used as arguments for a command. You can see this if you use sudo -ll to list what sudo has parsed. For your example it will say

/bin/sh -c 'echo 1 > /sys/...'

and it is expecting real quotes, so it would match, for example,

sudo sh -c "'echo 1 > /sys/...'"

What you can do is remove the quotes within the sudoers file and escape the spaces with backslash:

cestarian ALL = NOPASSWD: /bin/sh -c echo\ 1\ >\ /sys/...
3

It looks like sudo is having problems with arguments that contain quotes or whitespace. There may be a syntactically correct way of dealing with this, but the simplest solution is to move the shell commands to a separate file. E.g., create /usr/local/bin/enable_no_turbo with the content:

#!/bin/sh
echo 1 > /sys/devices/system/cpu/intel_pstate/no_turbo

Make it executable:

chmod 755 /usr/local/bin/enable-no-turbo

And enable it in your sudoers:

cestarian ALL = NOPASSWD: /usr/local/bin/enable-no-turbo

If you wanted a more generic solution, instead create /usr/local/bin/write-to-file with this content:

#!/bin/sh

echo "$2" > "$1"

And in your sudoers:

cestarian ALL = NOPASSWD: /usr/local/bin/write-to-file /sys/devices/system/cpu/intel_pstate/no_turbo 1

This will permit:

sudo write-to-file /sys/devices/system/cpu/intel_pstate/no_turbo 1

But will not permit any of:

sudo write-to-file /sys/devices/system/cpu/intel_pstate/no_turbo 0
sudo write-to-file /some/other/file 1

Etc.

3
  • I really like this solution, and i'm gonna use it, but i'm gonna wait and see if someone doesn't know how to bend the sudoers file to obey their will enough to make it work with those args before accepting this answer.
    – Cestarian
    Aug 6, 2022 at 18:33
  • There's a potential danger that such a write-to-file script could be used by mistake to overwrite a file that shouldn't be touched, such as /dev/mem. I don't consider this kind of script to be safe.
    – Sotto Voce
    Aug 7, 2022 at 18:02
  • @SottoVoce I'm not sure I see the risk: either you already have the permissions to do so, so you can do it without the script, or you've been explicitly granted permissions via the sudoers file, in which case you only have the ability to modify specific files. If you can explain more about the potential risk you envision I'd be interested.
    – larsks
    Aug 7, 2022 at 18:08
2

Alternative way is allowing tee such file in sudoers

username ALL = NOPASSWD: /bin/tee sys/devices/system/cpu/intel_pstate/no_turbo

Then using | sudo tee instead of >

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo
3
  • This works, although you might want to clarify your answer to be to add "username ALL = NOPASSWD: /bin/tee /sys/devices/system/cpu/intel_pstate/no_turbo" to sudoers (since adding tee by itself without args is too easily exploitable)
    – Cestarian
    Aug 6, 2022 at 22:39
  • @Cestarian good suggestion and done.
    – Hans Chen
    Aug 7, 2022 at 15:23
  • 1
    The downside to this is that it allows you to write arbitrary content to the target file (which maybe is just fine for your use case).
    – larsks
    Aug 7, 2022 at 18:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .