Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am configuring sudo on a server and have the following question. I only want a user group to run the /sbin/ifconfig. I have configured sudo:

User_Alias ​​NETWORK = user1 
Cmnd_Alias ​​NETWORKING = /sbin/ifconfig 
Host_Alias ​​MYHOSTS = localhost 

rule:

NETWORK MYHOSTS = (root) NETWORKING 

It works well for user user1: sudo ifconfig asks the password. But, I see that any computer user can run ifconfig also because the permissions on this file in /sbin are 755. Is it right? Should I also change the file permissions?

share|improve this question
    
Usually every user can run ifconfig, but cannot make modifications like ifconfig eth0 down which requires root/sudo. –  mpy Feb 10 at 9:37
    
Then sudo command not completely blocked, but only certain actions. Although this is not a user in the sudo file permissions will continue having regular file, is that correct? –  aelbaz Feb 10 at 10:27
    
Correct, if I understand you right. In my own words: sudo only checks permissions if a command is executed via sudo command. Otherwise only the file system permissions (or other security mechanisms) are obeyed. –  mpy Feb 10 at 10:34
1  
@aelbaz: What do you mean by 'permissions will continue having regular file'? The effect of sudo /sbin/ifconfig (...) is to run the /sbin/ifconfig command as user root, who can do more with that command than a regular user can, not because of the permissions set on /sbin/ifconfig or because of the lines in the sudo configuration, but because of permissions set on other files that are used by /sbin/ifconfig. –  reinierpost Feb 10 at 10:39

1 Answer 1

up vote 2 down vote accepted

From the sudo manpage:

sudo allows a permitted user to execute a command as the superuser or another user, as specified by the security policy.

That does not affect the regular (file system) permissions. So, if an executable has permissions 755 (-rwxr-xr-x) every user on the system can execute it. But -- depending on the executable -- for some operations you get a permission denied error:

$ ls -l /sbin/ifconfig
-rwxr-xr-x 1 root root 67912 May 11  2013 /sbin/ifconfig
$ whoami
user
$ /sbin/ifconfig
eth0      Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:29886 errors:0 dropped:0 overruns:0 frame:0
          TX packets:17383 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:3706932 (3.5 MiB)  TX bytes:34965406 (33.3 MiB)
$ /sbin/ifconfig eth0 down
SIOCSIFFLAGS: Operation not permitted
$ sudo /sbin/ifconfig eth0 down
[sudo] password for user:
 - no error -
$ 

Please note that changing the permissions of /sbin/ifconfig to 700 (-rwx-----) will prevent normal users to execute it, but there might be others means to gain the information. E. g. the IP address via ip address or the /proc file system.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.