1

How can I let a user U to run a command /usr/bin/C as a member of a group G (while he does not belong to the group G), using sudoers on Debian Wheezy?

1 Answer 1

1

Given:

U = an user G = a group to which user doesn't belong C = a command M = the machine

if you've got the line:

U M=:G C

so if you want user 'test' launch command 'touch' as group 'whatever' on machine 'aserver' you should add:

test aserver=(:whatever) /usr/bin/touch

in sudoers, then you'll be able to launch touch as group whatever via:

sudo -g whatever touch mytestfile
5
  • In my case command C is /usr/bin/nautilus-sendto which is normally called by a user through GUI (Nautilus), in order for things to remain transparent for the user I have to avoid using command line (sudo -g whatever touch mytestfile). So is there a way to make it transparent? Aug 8, 2013 at 10:17
  • @user1876484 - should this be U M=:G C and test aserver=:whatever /usr/bin/touch or U M=(:G) C and test aserver=(:whatever) /usr/bin/touch? Aug 8, 2013 at 10:30
  • 1
    the set should be: user machine=(:group) command Aug 8, 2013 at 10:39
  • @user1876484 - what about my first comment - how to make it Gnome-transparent. I thought to substitute the original /usr/bin/nautilus-sendto with a bash script that will have sudo -g floppy /usr/bin/nautilus-sendto.original $1 inside. But the problem is sudo wants to check the password of user - is there a way to force sudo to run the program without asking for password? Or maybe you have another workaround to make this Gnome-transparent? Aug 8, 2013 at 12:56
  • Wops, sorry: just saw your comment. NOPASSWD: flag before command alias should do the job: User Machine=(:Group) NOPASSWD: Command Aug 20, 2013 at 7:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .