permissions security sudo – Allow Specific User or Group Root Access Without Password to /bin/date

permissionsSecuritysudo

I'd like to give a user or group full root access to the /bin/date command, including any manner of arguments as defined in the man pages.

I understand /etc/sudoers expects explicit command definitions, so currently I have the following:

%some_group ALL=(root) NOPASSWD: /bin/date

e.g. I want any user in some_group to be able to run:

sudo /bin/date +%T "12:34:56"

Plus countless other combinations of arguments.

I guess my question is, is there a way to use regex or safe (emphasis on safe!) wildcards to achieve the finer granularity?

UPDATE

I managed to achieve something similar with Cmnd_Alias. Why this doesn't work without is a mystery beyond having time to read further on the inner-workings of sudo and sudoers.

Your syntax wasn't quite accepted, but I managed to achieve what I needed with the following:

Cmnd_Alias DATE=/bin/date
%some_group ALL=(root) NOPASSWD: DATE

This did exactly what I needed as a member of the defined group.

Best Answer

You can use the sudo command to accomplish this. If you add the following rule to your /etc/sudoers file like so:

As root or using sudo from your normal user account:

$ sudo visudo

This will open up the /etc/sudoers file in vi/vim. Once opened, add these lines:

Cmnd_Alias NAMEOFTHIS=/bin/date
ALL ALL=NOPASSWD: NAMEOFTHIS

Where "users" is a unix group that all the users are a member of. You can determine what group users are in with either the groups <username> command or look in the /etc/groups and /etc/passwd files.

If you have a section like this, I'd add the rules above here like so:

## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL

# my extra rules
Cmnd_Alias NAMEOFTHIS=/bin/date
ALL ALL=NOPASSWD: NAMEOFTHIS
Related Question