How to configure sudoers with path wildcards?

Question

I need sudo for a command for any path under a particular area. Example:

sudo mycommand /opt/apps/myapp/...

What is the sudoers syntax to allow this command to run in any path that falls under /opt/apps/myapp? This is Solaris 10 sudo.

---

Thank you for your reply, but I don't need wildcards for the path to the commands, but wildcards for the arguments for the commands.

For example, we want to do something like...

sudo mycmd /opt/userarea/area1
sudo mycmd /opt/userarea/area1/area2
sudo mycmd /opt/userarea/area1/area2/area3

So far, using wildcards for the arguments in sudoers look like this:

/opt/userarea/*
/opt/userarea/*/*

And it seems like if we want to have N levels of directories, then we need N lines in sudoers! Is there a better way to include all N levels in one line in sudoers? Thanks.

Answer 1

Edit - you should have been migrated to superuser.com but that hasn't happened yet. Never mind, I'll answer here.

Sudo is controlled by the file /etc/sudoers which tells it what it can and can't do. I don't know if you can achieve what you want to for the very reason I mentioned below, however, you can create a group of commands like so:

Cmnd_Alias TESTAPPS = /opt/dev/myapp/myapp1, /opt/dev/myapp/myapp2

You can then allow certain groups the ability to run sudo using just these commands. I have this set in mine:

root    ALL=(ALL)       ALL
%wheel  ALL=(ALL)       ALL

You could also add to that:

%development    ALL=(TESTAPPS)   ALL

Confusingly, the ALL in the first case indicates ALL hosts you are logging in from, so you can prevent sudo being run from certain hosts.

Just a quick warning - if you do this and enable write access to this area, the user can just copy commands from say /bin, /usr/bin or whatever and run what they like as root. So I could run sudo /opt/apps/myapp/rm -rf / and it would work. You also need to restrict where these commands can run.