Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

is there a straight-forward way to allow a user to run (for example)

/usr/bin/pacman -S -u

as root, without allowing him to run

/usr/bin/pacman -S -u some_package


The line

user ALL=(root) NOPASSWD: /usr/bin/pacman -S -u

allows both, and

user ALL=(root) NOPASSWD: /usr/bin/pacman -S -u ""

appears to be semantically equivalent.

share|improve this question
up vote 22 down vote accepted

For your case try something like this:

Cmnd_Alias PACMAN = /usr/bin/pacman -S -u, ! /usr/bin/pacman -S -u some_package

You can use shell glob patterns like [a-z],[0-9],* etc. in your sudoers file to exclude packages that match a certain pattern.

share|improve this answer
thanks! 7 more to go.. – nisc Jul 27 '10 at 21:51

Write a script that does what you want and give sudo access to it.

Also make sure that whatever environment this is run in does not have access to the networking at all, or they can just use their own dns to spoof the mirror and then run arbitrary code as root when it gets installed by pacman.

share|improve this answer
thats not an elegant way, sudo supports by default the exact given case – matthias krull Jul 26 '10 at 10:59
Not the best solution, but +1 for security warning – Aaron J Lang Nov 10 '14 at 12:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .