Bugzilla – Bug 335
runas_default doesn't work in the context of Command Defaults
Last modified: 2009-02-20 15:55:48 MST
What I'm trying to do is make it so that user's don't have to specify the '-u <user>' when attempting to run certain commands that would otherwise require specifying that user. I know that 1.7 is supposed to have Command specific Defaults (e.g., Defaults!<command> <option>), however I haven't been able to make runas_default work with command specific defaults and am hoping I'm just doing it wrong. (Note: this works (obviously?) if I do a user specific default) ----------------- Example Sudoers Snippet --------] Defaults:rabbitt !authenticate # just for testing purposes Defaults!/usr/bin/whoami runas_default=apache rabbitt ALL = (apache) NOPASSWD: /usr/bin/whoami ----------------- Expected Test Results ----------] -[rabbitt@optimus]- -[/tmp]- $ sudo whoami apache ----------------- Actual Test Results ------------] -[rabbitt@optimus]- -[/tmp]- $ sudo whoami Sorry, user rabbitt is not allowed to execute '/usr/bin/whoami' as root on optimus. --------------------------------------------------] TIA!, -- Carl P. Corliss
Normally, the runas user is already set by the time sudo does its search for the command to run. There's a slight chicken and egg problem here since sudo searches for the command in the PATH running with the uid of user it is going to run things as. If runas_default is set based on the command (and thus after the path search is complete), there are some cases where permission can get in the way. Adding a callback to set the runas password should do the trick for your use case though. I'll attach a simple patch that works for me here/
Created attachment 241 [details] add callback to set runas user
awesome - that patch works perfectly for me. One note about it tho - it seems the visudo.c diff ended up containing the diffs for sudo.(c|h) and defaults.c as well (so they are duplicated) - it caused patch to think that you want to reverse the patches. Will this make it into the next point release (it's certainly something we'd like to use at my employer (nytimes))? Thanks a bunch for the speedy response!, -- Carl
Created attachment 243 [details] update runas user after parsing command defaults
New, simpler fix that plays nicely with the -u flag. This will go into sudo 1.7.1