Sudoers Command
up vote
0
down vote
favorite
I can't understand the difference in this two command's
USER ALL=(ALL) NOPASSWD: ALL
AND
USER ALL=(OTHERUSER) NOPASSWD: ALL
Can anyone explain the () change?
Thanks
command-line unix privileges sudoers
asked Nov 22 at 16:45
Pedro Macedo Vilas
31
add a comment |
up vote
0
down vote
favorite
I can't understand the difference in this two command's
USER ALL=(ALL) NOPASSWD: ALL
AND
USER ALL=(OTHERUSER) NOPASSWD: ALL
Can anyone explain the () change?
Thanks
command-line unix privileges sudoers
asked Nov 22 at 16:45
Pedro Macedo Vilas
31
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I can't understand the difference in this two command's
USER ALL=(ALL) NOPASSWD: ALL
AND
USER ALL=(OTHERUSER) NOPASSWD: ALL
Can anyone explain the () change?
Thanks
command-line unix privileges sudoers
asked Nov 22 at 16:45
Pedro Macedo Vilas
31
I can't understand the difference in this two command's
USER ALL=(ALL) NOPASSWD: ALL
AND
USER ALL=(OTHERUSER) NOPASSWD: ALL
Can anyone explain the () change?
Thanks
command-line unix privileges sudoers
command-line unix privileges sudoers
asked Nov 22 at 16:45
Pedro Macedo Vilas
31
asked Nov 22 at 16:45
Pedro Macedo Vilas
31
asked Nov 22 at 16:45
Pedro Macedo Vilas
31
asked Nov 22 at 16:45
Pedro Macedo Vilas
31
asked Nov 22 at 16:45
Pedro Macedo Vilas
31
31
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
up vote
0
down vote
accepted
From man 5 sudoers:
The basic structure of a user specification is
who where = (as_whom) what.
And
The reserved word
ALLis a built-in alias that always causes a match to succeed.
In your case the difference is in (as_whom) field:
(ALL)means it's possible forUSERto run commands as any user.
(OTHERUSER)means it's possible forUSERto run commands asOTHERUSER(e.g.sudo -u OTHERUSER whoami).
Note it doesn't mean
USERcannot run commands asYETANOTHERUSER. IfUSERtries to run something asYETANOTHERUSERthen the line with(OTHERUSER)won't match and the parser will continue; some later line may match.
answered Nov 22 at 17:22
Kamil Maciorowski
22.8k155072
So theUSERcan execute sudo commands asOTHERUSERname or will have only the privileges of theOTHERUSER?.
– Pedro Macedo Vilas
Nov 22 at 18:11
@PedroMacedoVilas The user chooses whom to impersonate explicitly withsudo -u chosen_user some_command, like in the example I added to my answer. If the user is allowed to runsome_commandaschosen_userthen the command will run with privileges ofchosen_user.
– Kamil Maciorowski
Nov 22 at 18:19
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
accepted
From man 5 sudoers:
The basic structure of a user specification is
who where = (as_whom) what.
And
The reserved word
ALLis a built-in alias that always causes a match to succeed.
In your case the difference is in (as_whom) field:
(ALL)means it's possible forUSERto run commands as any user.
(OTHERUSER)means it's possible forUSERto run commands asOTHERUSER(e.g.sudo -u OTHERUSER whoami).
Note it doesn't mean
USERcannot run commands asYETANOTHERUSER. IfUSERtries to run something asYETANOTHERUSERthen the line with(OTHERUSER)won't match and the parser will continue; some later line may match.
answered Nov 22 at 17:22
Kamil Maciorowski
22.8k155072
So theUSERcan execute sudo commands asOTHERUSERname or will have only the privileges of theOTHERUSER?.
– Pedro Macedo Vilas
Nov 22 at 18:11
@PedroMacedoVilas The user chooses whom to impersonate explicitly withsudo -u chosen_user some_command, like in the example I added to my answer. If the user is allowed to runsome_commandaschosen_userthen the command will run with privileges ofchosen_user.
– Kamil Maciorowski
Nov 22 at 18:19
add a comment |
up vote
0
down vote
accepted
From man 5 sudoers:
The basic structure of a user specification is
who where = (as_whom) what.
And
The reserved word
ALLis a built-in alias that always causes a match to succeed.
In your case the difference is in (as_whom) field:
(ALL)means it's possible forUSERto run commands as any user.
(OTHERUSER)means it's possible forUSERto run commands asOTHERUSER(e.g.sudo -u OTHERUSER whoami).
Note it doesn't mean
USERcannot run commands asYETANOTHERUSER. IfUSERtries to run something asYETANOTHERUSERthen the line with(OTHERUSER)won't match and the parser will continue; some later line may match.
answered Nov 22 at 17:22
Kamil Maciorowski
22.8k155072
So theUSERcan execute sudo commands asOTHERUSERname or will have only the privileges of theOTHERUSER?.
– Pedro Macedo Vilas
Nov 22 at 18:11
@PedroMacedoVilas The user chooses whom to impersonate explicitly withsudo -u chosen_user some_command, like in the example I added to my answer. If the user is allowed to runsome_commandaschosen_userthen the command will run with privileges ofchosen_user.
– Kamil Maciorowski
Nov 22 at 18:19
add a comment |
up vote
0
down vote
accepted
up vote
0
down vote
accepted
From man 5 sudoers:
The basic structure of a user specification is
who where = (as_whom) what.
And
The reserved word
ALLis a built-in alias that always causes a match to succeed.
In your case the difference is in (as_whom) field:
(ALL)means it's possible forUSERto run commands as any user.
(OTHERUSER)means it's possible forUSERto run commands asOTHERUSER(e.g.sudo -u OTHERUSER whoami).
Note it doesn't mean
USERcannot run commands asYETANOTHERUSER. IfUSERtries to run something asYETANOTHERUSERthen the line with(OTHERUSER)won't match and the parser will continue; some later line may match.
answered Nov 22 at 17:22
Kamil Maciorowski
22.8k155072
From man 5 sudoers:
The basic structure of a user specification is
who where = (as_whom) what.
And
The reserved word
ALLis a built-in alias that always causes a match to succeed.
In your case the difference is in (as_whom) field:
(ALL)means it's possible forUSERto run commands as any user.
(OTHERUSER)means it's possible forUSERto run commands asOTHERUSER(e.g.sudo -u OTHERUSER whoami).
Note it doesn't mean
USERcannot run commands asYETANOTHERUSER. IfUSERtries to run something asYETANOTHERUSERthen the line with(OTHERUSER)won't match and the parser will continue; some later line may match.
answered Nov 22 at 17:22
Kamil Maciorowski
22.8k155072
edited Nov 22 at 18:09
answered Nov 22 at 17:22
Kamil Maciorowski
22.8k155072
answered Nov 22 at 17:22
Kamil Maciorowski
22.8k155072
answered Nov 22 at 17:22
Kamil Maciorowski
22.8k155072
22.8k155072
So theUSERcan execute sudo commands asOTHERUSERname or will have only the privileges of theOTHERUSER?.
– Pedro Macedo Vilas
Nov 22 at 18:11
@PedroMacedoVilas The user chooses whom to impersonate explicitly withsudo -u chosen_user some_command, like in the example I added to my answer. If the user is allowed to runsome_commandaschosen_userthen the command will run with privileges ofchosen_user.
– Kamil Maciorowski
Nov 22 at 18:19
add a comment |
So theUSERcan execute sudo commands asOTHERUSERname or will have only the privileges of theOTHERUSER?.
– Pedro Macedo Vilas
Nov 22 at 18:11
@PedroMacedoVilas The user chooses whom to impersonate explicitly withsudo -u chosen_user some_command, like in the example I added to my answer. If the user is allowed to runsome_commandaschosen_userthen the command will run with privileges ofchosen_user.
– Kamil Maciorowski
Nov 22 at 18:19
So the
USER can execute sudo commands as OTHERUSER name or will have only the privileges of the OTHERUSER?.– Pedro Macedo Vilas
Nov 22 at 18:11
So the
USER can execute sudo commands as OTHERUSER name or will have only the privileges of the OTHERUSER?.– Pedro Macedo Vilas
Nov 22 at 18:11
@PedroMacedoVilas The user chooses whom to impersonate explicitly with
sudo -u chosen_user some_command, like in the example I added to my answer. If the user is allowed to run some_command as chosen_user then the command will run with privileges of chosen_user.– Kamil Maciorowski
Nov 22 at 18:19
@PedroMacedoVilas The user chooses whom to impersonate explicitly with
sudo -u chosen_user some_command, like in the example I added to my answer. If the user is allowed to run some_command as chosen_user then the command will run with privileges of chosen_user.– Kamil Maciorowski
Nov 22 at 18:19
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1377626%2fsudoers-command%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
