I am trying to allow a user sudo
access to NOPASSWD
but something seems to be overridding the config? First invocation of sudo
asks for a password.
Here is the output of the users sudo
permissions and trying to run a command as another user through sudo
.
Am I missing something here?
╭─ ~ ────────────────────────────────────────────────────────────────────────────────────── with baudneo@ZoneMinder at 12:35:25 PM
╰─❯ sudo -l -U baudneo
Matching Defaults entries for baudneo on ZoneMinder:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User baudneo may run the following commands on ZoneMinder:
(ALL : ALL) NOPASSWD: ALL
(ALL : ALL) NOPASSWD: ALL
(ALL : ALL) ALL
╭─ ~ ────────────────────────────────────────────────────────────────────────────────────── with baudneo@ZoneMinder at 12:36:28 PM
╰─❯ groups
baudneo sudo
╭─ ~ ────────────────────────────────────────────────────────────────────────────────────── with baudneo@ZoneMinder at 12:36:09 PM
╰─❯ sudo -u www-data zmml_eventproc -E -e 1263 -m 7 -D -C /etc/zm/client.yml
Sorry, user baudneo is not allowed to execute '/usr/local/bin/zmml_eventproc -E -e 1263 -m 7 -D -C /etc/zm/client.yml' as www-data on ZoneMinder.localdomain.
Edit: Ubuntu 22.04 LXC, I am trying to run a python script as the www-data user, my permissions and sudo config seem correct.
Edit 2: It was a full disk issue, after making space on the disk the command runs as www-data.
baudneo
user here. Can you runsudo zmml_eventproc -E -e 1263 -m 7 -D -C /etc/zm/client.yml
(without-u www-data
)?sudo -l
prints(ALL : ALL) ALL
after(ALL : ALL) NOPASSWD: ALL
and this explains whysudo
asks for password. I'm not sure whyuser baudneo is not allowed to execute …
though. I wonder ifZoneMinder
vsZoneMinder.localdomain
has anything to do with it.Runas_Spec
which shall allow thesudo -u www-data zmml_eventproc
command to your question, including theHost_Alias
. It seems that instead ofALL =
you actually have a host defenition (ZoneMinder
) but use thefqdn
flag so that this has to beZoneMinder.localdomain
instead (or just remove the flag, if that does not cause other problems, of course).