Geek Answers Handbook

How to enable bash -c for sudoers (followed by a few commands)?

I have this in / etc / sudoers:

%wheel myhostname =NOPASSWD: /bin/bash -c "echo foo && echo bar", \ /bin/bash -c echo foo

Running sudo /bin/bash -c echo foo works without asking for a password.

However, sudo /bin/bash -c "echo foo && echo bar" still asks for a password.

I have tried many variations of this, but nothing is accepted.

Where is the error? / How to resolve -c followed by several commands?

+7
bash sudo sudoers
source share
2 answers

At least with my sudo (OS X 10.9, sudo 1.7.10p7) the quotes in /etc/sudoers match literally. That is, pointing

 /bin/bash -c "echo foo && echo bar"

means that users literally have to run

 sudo /bin/bash -c '"echo foo && echo bar"'

i.e. quotes must be passed to the program.

Therefore, all you have to do is just leave quotation marks in / etc / sudoers:

 %wheel myhostname =NOPASSWD: /bin/bash -c echo foo && echo bar

While this looks strange, it works completely on my machine: users can run /bin/bash -c "echo foo && echo bar" without a password. This works because, according to man sudoers , the only characters to be escaped are ',', ':', '=' and '\' .

Note that this means that sudo basically concatenates all command-line arguments with spaces to match: users can also execute /bin/bash -c "echo foo" "&&" "echo bar" . Therefore, you should make sure that none of the arguments can be individually dangerous for security (for example, that foo , && and bar cannot be used to use your computer).

+2
source share

The problem is how the interpretation of your arguments in your shell. If I am in bash (most of the other shells work the same way) and I type the command

 sudo /bin/bash -c "echo foo && echo bar"

sudo is called with everything after it as arguments. However, the shell processes each argument before passing it to sudo . One of the things she does is to exclude quotation marks around quoted arguments. Therefore, the arguments that sudo receives as the argv value are an array that looks like this (one argument per line):

 /bin/bash -c echo foo && echo bar

sudo combines them with spaces and compares them with the commands in the sudoers file (this is actually a bit more complicated than that, since it replaces wildcards, etc.). So the command that he actually sees what you are doing is to check the permissions -

 /bin/bash -c echo foo && echo bar

When I put this command in a sudoers file, I do not ask for a password when I type

 sudo /bin/bash -c "echo foo && echo bar"

However, I also do not request a password when entering any of these commands or other similar ones.

 sudo /bin/bash "-c echo foo && echo bar" sudo /bin/bash "-c echo" foo "&& echo" bar sudo /bin/bash -c echo "foo && echo" bar

In general, as far as I know, there is no way for sudo (or any program) to know exactly which command was entered, but only what it converts into a shell for execution purposes.

+4
source share

More articles:


All Articles