so, what I want is:

  • to be able to run /sbin/print/managequeue.sh -p app1 --view as another user without asking password.
  • to be able to run /sbin/print/managequeue.sh -p app1 --cancel (or --delete, or --pause, etc) as another user but asking for password.

Preferably, I didn´t want to create a Cmnd_Alias with all possible arguents. So, I tried the three aliases and the User Specification below:

Host_Alias      PRINTSRVS = printsrv, printsrvbkp
Cmnd_Alias      APP1PMV = /sbin/print/managequeue.sh -p app1 --view
Cmnd_Alias      APP1PMD = /sbin/print/managequeue.sh -p app1 *, !APP1PMV

%app1adms, %helpdesk PRINTSRVS = (printop2:printop2) NOPASSWD: APP1PMV, \
                                 (printop2:printop2) PASSWD: APP1PMD

When I run sudo -u printop2 /sbin/print/managequeue.sh -p app1 --cancel it works:

[sudo] password for app1adm1:
Managing queue...

But when I run sudo -u printop2 /sbin/print/managequeue.sh -p app1 --view it doesn't:

Sorry, user app1adm1 is not allowed to execute '/sbin/print/managequeue.sh -p app1 --view' as printop2 on printsrv.

Apparently my second command (printop2:printop2) PASSWD: APP1PMD overrode my first command (printop2:printop2) NOPASSWD: APP1PMV and denied the --view argument altogether.

Can anyone explain what is going on?

EDIT: My sudo -ll restult for user app1adm1 is:

sudo -ll
User app1adm1 may run the following commands on printsrv:

Sudoers entry:
    RunAsUsers: root
    Commands:
        /sbin/app[12]/*

Sudoers entry:
    RunAsUsers: printop2
    RunAsGroups: printop2
    Options: !authenticate
    Commands:
        /sbin/print/managequeue.sh -p app1 --view

Sudoers entry:
    RunAsUsers: printop2
    RunAsGroups: printop2
    Options: authenticate
    Commands:
        /sbin/print/managequeue.sh -p app1 *
        !/sbin/print/managequeue.sh -p app1 --view

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.