1

I am configuring sudo on a server and have the following question. I only want a user group to run the /sbin/ifconfig. I have configured sudo:

User_Alias ​​NETWORK = user1 
Cmnd_Alias ​​NETWORKING = /sbin/ifconfig 
Host_Alias ​​MYHOSTS = localhost 

rule:

NETWORK MYHOSTS = (root) NETWORKING 

It works well for user user1: sudo ifconfig asks the password. But, I see that any computer user can run ifconfig also because the permissions on this file in /sbin are 755. Is it right? Should I also change the file permissions?

4
  • Usually every user can run ifconfig, but cannot make modifications like ifconfig eth0 down which requires root/sudo.
    – mpy
    Feb 10, 2014 at 9:37
  • Then sudo command not completely blocked, but only certain actions. Although this is not a user in the sudo file permissions will continue having regular file, is that correct?
    – aelbaz
    Feb 10, 2014 at 10:27
  • Correct, if I understand you right. In my own words: sudo only checks permissions if a command is executed via sudo command. Otherwise only the file system permissions (or other security mechanisms) are obeyed.
    – mpy
    Feb 10, 2014 at 10:34
  • 1
    @aelbaz: What do you mean by 'permissions will continue having regular file'? The effect of sudo /sbin/ifconfig (...) is to run the /sbin/ifconfig command as user root, who can do more with that command than a regular user can, not because of the permissions set on /sbin/ifconfig or because of the lines in the sudo configuration, but because of permissions set on other files that are used by /sbin/ifconfig. Feb 10, 2014 at 10:39

1 Answer 1

2

From the sudo manpage:

sudo allows a permitted user to execute a command as the superuser or another user, as specified by the security policy.

That does not affect the regular (file system) permissions. So, if an executable has permissions 755 (-rwxr-xr-x) every user on the system can execute it. But -- depending on the executable -- for some operations you get a permission denied error:

$ ls -l /sbin/ifconfig
-rwxr-xr-x 1 root root 67912 May 11  2013 /sbin/ifconfig
$ whoami
user
$ /sbin/ifconfig
eth0      Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:29886 errors:0 dropped:0 overruns:0 frame:0
          TX packets:17383 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:3706932 (3.5 MiB)  TX bytes:34965406 (33.3 MiB)
$ /sbin/ifconfig eth0 down
SIOCSIFFLAGS: Operation not permitted
$ sudo /sbin/ifconfig eth0 down
[sudo] password for user:
 - no error -
$ 

Please note that changing the permissions of /sbin/ifconfig to 700 (-rwx-----) will prevent normal users to execute it, but there might be others means to gain the information. E. g. the IP address via ip address or the /proc file system.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .