1

I'm trying to allow my user (via sudo, launched in a script) to copy a file from their home to a web directory.

Command would be:

sudo cp /home/$LOGNAME/file_source /var/www/$LOGNAME_file_dest

So i added the following line in my sudoers file:

%users ALL=(ALL)NOPASSWD:/bin/cp /home/$LOGNAME/file_source /var/www/$LOGNAME_file_dest

This doesn't quite works, because sudo asks me for a password and it should not. I guess this is a problem with the $LOGNAME variable that is not interpreted in sudoer file or somehthing like that.

I almost forgot to mention that I'm a control freak, this has to be a very strict condition, no * or anything else tolerated.

Has anyone a solution to such a problem or should I go the painful way and allow 1 by 1 user to cp his file to the /var/www directory?

0

3 Answers 3

3

Shell variables are interpreted by your shell, and are never seen by sudo or any other program launched with them. That is, when doing foo=bar; echo "$foo", echo never knows that the data it was passed came from a variable called "foo", because the shell expands it before echo is even executed. For this reason, it isn't possible to make shell variables work transparently in your sudoers file.

Also, since $LOGNAME could be anything, what you are wanting to do is essentially equivalent to using a star after /home in your sudoers, regardless of whether you use it or not. I would not recommend doing this, because you can essentially copy anything to anywhere as root, which is a huge security risk (since $LOGNAME can contain ..). Ultimately, you say you don't want to use *, but the action you are wanting to take is equally dangerous.

The best option is to allow read access to whatever is at /home/$LOGNAME/file_source, and write access for these users to /var/www. You could have a www-logs group that has group read and group write for these paths, respectively.

8
  • Hi Chris, thank you very much for the answer. This is all sad news for me because alowing users write access to /var/www won't do either for security constraints. Humm I understand what you are explaining real good. Guess I'll have to figure something out. Maybe a job running every 1 min/30s synchronyzing my file from users home to /var/www running in root account or else. Think it could be a way...
    – trox
    Commented May 29, 2013 at 3:27
  • Also, what about env_keep? $LOGNAME, $USER and so on are env varibale... Nevrmind it's used later on when the command is executed...
    – trox
    Commented May 29, 2013 at 3:43
  • Isn't there any way to use regexp for sudo condition checks, that would be really usefull, at least to me :)
    – trox
    Commented May 29, 2013 at 4:13
  • 1
    $LOGNAME can be arbitrary, how would that be safer?
    – Chris Down
    Commented May 29, 2013 at 5:15
  • @trox If all you're attempting to do is let them copy files into a directory they should have write access to, it sounds like a job for the scripted application of POSIX ACL's. You don't have to give them write access to entire directory trees but you can give just these users write access to particular directories.
    – Bratchley
    Commented May 29, 2013 at 11:25
1

Joel Davis has the correct answer, thank you all very much for your kind help! "scripted application of POSIX ACL's" that is!

And: https://stackoverflow.com/questions/869536/linux-directory-permissions-read-write-but-not-delete

Example: (Create files, once written, they are read only, but CAN be deleted by owner, but not others.)

setfacl --set u::rwxs,g::rwx /controlled
setfacl -d --set u::r-x,g::r-x,o::- /controlled

This is exactly what I need to do.

Thank you all very much for you help, I should have asked this question differently.

0

Create a script which performs the copying after any necessary checks, and grant sudo access to that.

Note that privileged shell scripts are considered bad practice; you might want to go for e. g. Python or Perl instead.

The environment created by sudo should already prevent the user from overriding library paths etc but you may want to take some extra steps to bolt it down so that only a minimal set of system library paths are allowed.

1
  • Yes that was also somehting I had in mind but prefered not to do.
    – trox
    Commented May 29, 2013 at 22:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .