2

Is this combination legal:

username ALL=(ALL) NOPASSWD: /usr/bin/foo, PASSWD:ALL

or do they conflict or cancel each other out?

4

Looking at the sudoers man page I would say that you can do them together:

Tag_Spec
  A command may have zero or more tags associated with it.  There are eight
  possible tag values, NOPASSWD, PASSWD, NOEXEC, EXEC, SETENV, NOSETENV,
  LOG_INPUT, NOLOG_INPUT, LOG_OUTPUT and NOLOG_OUTPUT.  Once a tag is set on 
  a Cmnd, subsequent Cmnds in the Cmnd_Spec_List, inherit the tag unless it 
  is overridden by the opposite tag (i.e.: PASSWD overrides NOPASSWD and 
  NOEXEC overrides EXEC).

The PASSWD:ALL will override the NOPASSWD afterwards. There is even an example that shows what you're trying in the man page.

By default, sudo requires that a user authenticate him or herself before running a command. This behavior can be modified via the NOPASSWD tag. Like a Runas_Spec, the NOPASSWD tag sets a default for the commands that follow it in the Cmnd_Spec_List. Conversely, the PASSWD tag can be used to reverse things. For example:

ray     rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm

References

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.