Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My user "craig" is in the /etc/sudoers file on my CentOS 5.6 VM, however when I try to access the crontab using the command below I am presented with an error message:

sudo crontab -e -u crmpicco-stock-dev
[sudo] password for craig:
Sorry, user craig is not allowed to execute '/usr/bin/crontab -e' as root on dev.localdomain.

Why do I get this message as I can see in my /etc/sudoers file that I can access the crontab requested.

Here is the entry from my /etc/sudoers file:

craig   ALL=(crmpicco-stock-dev) /usr/bin/crontab, /var/spool/cron/crmpicco-stock-dev
share|improve this question
add comment

3 Answers

Can you try to do :

sudo crontab -u crmpicco-stock-dev -e

From the man page this seem the correct order.

Best Regards

share|improve this answer
    
No, this produces the same error. So I don't think the order matters here. [craig@dev53 dev_crmpicco]$ sudo crontab -u crmpicco-stock-dev -e [sudo] password for craig: Sorry, user craig is not allowed to execute '/usr/bin/crontab -u crmpicco-stock-dev -e' as root on dev.localdomain. –  crmpicco Dec 20 '12 at 17:03
    
An alternative could be to run: sudo su -c "crontab -e" crmpicco-stock-dev –  ricciocri Dec 20 '12 at 17:19
    
Same again, unfortunately. Sorry, user craig is not allowed to execute '/bin/su -c crontab -e crmpicco-stock-dev' as root on dev.localdomain. –  crmpicco Dec 20 '12 at 17:22
    
Have you changed /etc/sudoers to allow craig to execute /bin/su ? –  ricciocri Dec 20 '12 at 17:39
    
I have editedmy sudoers file with visudo to include the line Cmnd_Alias SU = /bin/su, there is no mention of the craig user in the file. Should adding the command alias line open it up for all users? After adding this line there has been no change to the problem - i'm still unable to access the crmpicco-stock-dev crontab with the craig user. Anything else I can try? –  crmpicco Jan 7 '13 at 11:44
show 1 more comment

I believe that you are going to have to contact your system administrator to help you in debugging the problem. I suspect that it is some type of artifact from either the setuid() or seteuid() calls in sudo and the fact that you are calling a SUID program. I've seen this before and it is most frustrating to fix.

How I might start to fix it is by trying to put the crontab call in an executable wrapper program with no special perms itself and using sudo to call the wrapper program instead.

share|improve this answer
add comment

The specification ALL=(crmpicco-stock-dev) /usr/bin/crontab means that on ALL hosts, you are allowed to run /usr/bin/crontab as the user crmpicco-stock-dev. This does not mean that sudo will, whenever you try to run /usr/bin/crontab, automatically select to do so as crmpicco-stock-dev - the default is still root, which the config disallows, and the error message gives it away: Sorry, user craig is not allowed [...] as root.

Try running sudo -u crmpicco-stock-dev crontab -e. That will tell sudo that you want to be crmpicco-stock-dev and invoke /usr/bin/crontab, whch should be allowed; crontab -e will by default try to edit the crontab of the current user - which will be crmpicco-stock-dev, so you don't need to specify that again.

Putting the -u crmpicco-stock-dev after the first non-option, sudo will assume it's part of the command you want to run, and ignore it. The whole line looks similar, but means something very different.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.