use sudo command but NOT be in 'admin' or 'wheel'

meancode · 03-03-2002, 07:24 PM

related thread (http://forums.macosxhints.com/showth...&threadid=1360) i concocted an apple script to change the startup system folder. only problem is 'bless' needs to be run as root. and if the user is not setup with admin privs, it cannot use the sudo command b/c they are in the wrong group. i realize this is a security measure, but is there a wat around this. so that i can have my script and eat it too. i would like to be able to run the script as a non admin. can anyone help? i posted this seperate b/c it is more or less a general question for any command that reguires to be run as root.

maclaw · 03-03-2002, 07:48 PM

you can add additional users or groups to the sudoers file (using visudo) but giving sudo privileges to a non-admin is (as you suggested) a major security risk. In fact, it sort of defeats the whole purpose of using a non-admin user account.

mervTormel · 03-03-2002, 08:29 PM

you can add your user to the sudoers file AND specify which commands they are allowed to run...

user host=command(s)

# User privilege specification
root ALL=(ALL) ALL
%admin ALL=(ALL) ALL
betty saturn=/usr/sbin/bless,/sbin/shutdown

gives user betty on host saturn the ability to run bless and shutdown

check the sudoers man pages for exact syntax and test test test on a test user

WillyT · 03-05-2002, 11:45 AM

If you're logged in to an non-admin account you can su to your admin account and sudo from there.

Not as elegant as adding to sudoers list but great for fixing things while testing or assisting another account.

But remember to exit if you're doing an assist.

Another possibility is to have the script run as setuid.

Code:

sudu chmod 4755 TheScript

Be careful here as I believe the WHOLE script will run as root.
So you may want to make just the one root command in a script and call it from another.

03-03-2002, 07:24 PM	#1
meancode Triple-A Player Join Date: Jan 2002 Location: Bowling Green, Ohio Posts: 212	use sudo command but NOT be in 'admin' or 'wheel' related thread (http://forums.macosxhints.com/showth...&threadid=1360) i concocted an apple script to change the startup system folder. only problem is 'bless' needs to be run as root. and if the user is not setup with admin privs, it cannot use the sudo command b/c they are in the wrong group. i realize this is a security measure, but is there a wat around this. so that i can have my script and eat it too. i would like to be able to run the script as a non admin. can anyone help? i posted this seperate b/c it is more or less a general question for any command that reguires to be run as root. __________________ Ken Edwards Breaking Windows (Personal Blog)

03-05-2002, 11:45 AM	#4
WillyT Major Leaguer Join Date: Jan 2002 Location: Midwest Not quite Normal Posts: 416	su to admin account If you're logged in to an non-admin account you can su to your admin account and sudo from there. Not as elegant as adding to sudoers list but great for fixing things while testing or assisting another account. But remember to exit if you're doing an assist. Another possibility is to have the script run as setuid. Code: sudu chmod 4755 TheScript Be careful here as I believe the WHOLE script will run as root. So you may want to make just the one root command in a script and call it from another. Last edited by WillyT; 03-05-2002 at 12:08 PM.

03-03-2002, 07:48 PM	#2
maclaw Prospect Join Date: Jan 2002 Posts: 35	you can add additional users or groups to the sudoers file (using visudo) but giving sudo privileges to a non-admin is (as you suggested) a major security risk. In fact, it sort of defeats the whole purpose of using a non-admin user account.

03-03-2002, 08:29 PM	#3
mervTormel League Commissioner Join Date: Jan 2002 Posts: 5,536	you can add your user to the sudoers file AND specify which commands they are allowed to run... user host=command(s) # User privilege specification root ALL=(ALL) ALL %admin ALL=(ALL) ALL betty saturn=/usr/sbin/bless,/sbin/shutdown gives user betty on host saturn the ability to run bless and shutdown check the sudoers man pages for exact syntax and test test test on a test user