64

According to the comments in /etc/sudoers (Fedora 13):

## Syntax:
##
##    user  MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.

My two related questions:

  1. What does the ALL=(ALL) ALL mean in the following line:

    root  ALL=(ALL)   ALL

  2. I've tested these two lines but I cannot figure out how they are functionally different:

    superadm    ALL=(ALL)    ALL
superadm    ALL=ALL

I've read the manual but the syntax specification is difficult to follow. I have derived that the (ALL) ALL part is the command and tag specifications but I still cannot get my head around it.

Jeff Schaller
  • 67,283
  • 35
  • 116
  • 255
Belmin Fernandez
  • 9,597

2 Answers2

117

Note: I'm answering 1., since Ignacio already answered 2..

In the following sudo entry:

superadm  ALL=(ALL)   ALL

there are four fields:

  • The first one specifies a user that will be granted privileges for some command(s).
  • The second one is rarely used. It's a list of hostnames on which this sudo entry will be effective. On standard setups only one host is relevant (localhost) so this field is usually left as ALL.
  • The fourth field is the list of commands superadm will be able to run with elevated privileges. ALL means all commands. Otherwise use a comma-separated list of commands.
  • The third field (the one written (…) that is optional) specifies which users (and groups) the superadm user will be able to run the following commands as. ALL means they can choose anything (unrestricted). It this field is omitted, it means the same as (root).

Example:

alan   ALL = (root, bin : operator, system) /bin/ls, /bin/kill

Here, alan is allowed to run the two commands /bin/ls and /bin/kill as root (or bin), possibly with additional operator or system groups privileges.

So alan may choose to run ls as the bin user and with operator's group privileges like this:

sudo -u bin -g operator /bin/ls /whatever/directory

If -u is omitted, it's the same as -u root. If -g is omitted, no additional group privileges are granted.

Community
  • 1
Stéphane Gimenez
  • 28,907
  • 4
    Well, that's probably the best answer ever... – David Betz Feb 11 '16 at 20:46
  • 2
    I observed that a newline \n character is mandatory at the end of the entry in sudoers or /etc/sudoers.d/your_file_name – Ram on Rails Jun 23 '16 at 16:11
  • Also you can use wildcards in host names, path names and command line arguments. Like /bin/cat /var/log/messages.? or /bin/ls /var/log/* more info here – Alex Feb 27 '17 at 14:23
  • Just a little addition to this otherwise perfect answer: if there are multiple lines matching for a user in the sudoers-file, only the last match will be relevant. All other matches are ignored. This is something that can bite you in case you wonder why you do not get the privileges you just assigned yourself. In my case, it was the %admin group entry, that was much more restrictive than the one I created for my main user on my private machine. I kept wondering why the NOPASSWD entry I created for myself doesn't work and I still get asked the root-password every time I call sudo... – jackthehipster Apr 08 '22 at 19:23
11

From the sudoers(5) man page, DESCRIPTION section, Runas_Spec subsection:

The first Runas_List indicates which users the command may be run as via sudo’s -u option.

...

If no Runas_Spec is specified the command may be run as root and no group may be specified.

So there is no functional difference when trying to run commands as root, i.e., when not using -u with sudo. The difference matters when trying to run commands as other users; the latter will prevent this, but the former will allow it.

Ignacio Vazquez-Abrams
  • 45,725