5.8. Running Any Program in a Directory via sudo

Problem

Authorize a user to run all programs in a given directory, but only those programs, as another user.

Solution

Specify a fully-qualified directory name instead of a command, ending it with a slash:

               /etc/sudoers:
smith  ALL = (root) /usr/local/bin/

smith$ sudo -u root /usr/local/bin/mycommand       Authorized
smith$ sudo -u root /usr/bin/emacs                 Rejected

This authorization does not descend into subdirectories.

smith$ sudo -u root /usr/local/bin/gnu/emacs       Rejected

See Also

sudo(8), sudoers(5).

Get Linux Security Cookbook now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial