Contents
How are wildcards used in the sudoers file?
Wildcards sudo allows shell-style wildcards (aka meta or glob characters) to be used in hostnames, pathnames and command line arguments in the sudoers file. Wildcard matching is done via the POSIX glob (3) and fnmatch (3) routines.
Are there any exceptions to the Wildcard Rule?
Exceptions to wildcard rules The following exceptions apply to the above rules: “” If the empty string “” is the only command line argument in the sudoers entry it means that command is not allowed to be run with any arguments. As the wildcard in our example is part of the arguments and not the path name, it allows us to break out.
Can a Sudo wildcard match a regular expression?
NOTE THAT THESE ARE NOT REGULAR EXPRESSIONS. Unlike a regular expression there is no way to match one or more characters within a range. As others have indicated what you want is not supported by sudo, it only supports a generic wildcard. There are some serious dangers in using wildcards with the sudo ers format.
What are the two types of entries in sudoers?
The sudoers file is composed of two types of entries: aliases (basically variables) and user specifications (which specify who may run what). When multiple entries match for a user, they are applied in order.
Why does Sudo look for commands exactly as written?
Therefore sudo looks for commands exactly as written (excepting path-lookup) (from man 5 sudoers ): If a Cmnd has associated command line arguments, then the arguments in the Cmnd must match exactly those given by the user on the command line (or match the wildcards if there are any).
How are arguments specified in sudoers for plugins?
Multiple arguments may be specified, separated by white space. For example: The following plugin arguments are supported: The ldap_conf argument can be used to override the default path to the ldap.conf file. The ldap_secret argument can be used to override the default path to the ldap.secret file.
Why is shell not able to expand wildcard?
It’s almost certainly due to the fact that your ordinary user account cannot access the directory, so the shell cannot enumerate the files that would match the wildcard. If you get a permission denied then there is no way the shell is going to be able to expand a * wildcard in that directory.
Are there any security issues with the sudoers file?
The following article describes common security issues regarding misconfigured sudoers’ files. The article focuses on a single entry which contains several security issues: The article is split into the following five chapters: The last issue with our example “sudo” command is the wildcard (*). Excerpt from the “sudoers” man page:
When to use the find command in wildcard?
The find command can be used quite concisely in simple cases where you want to perform operations on wildcard (or more complex) filename matches. The technique below can be committed to memory almost ! This works by letting the find command run another command on each filename it finds.