8.3. Enabling unprivileged users to run certain commands

Procedure

1. As root, create a new sudoers.d/ directory under /etc/:

   # mkdir -p /etc/sudoers.d/

2. Create a new file in the /etc/sudoers.d/ directory:

   # visudo -f /etc/sudoers.d/<filename>

   The file opens automatically.

3. Add the following line to the /etc/sudoers.d/<filename> file:

   <username> <hostname.example.com> = (<run_as_user>:<run_as_group>) <path/to/command>

   • Replace <username> with the name of the user.
   • Replace <hostname.example.com> with the URL of the host.
   • Replace (<run_as_user>:<run_as_group>) with the user or group as which the command can be executed. If you omit this section, <username> can execute the command as root.
   • Replace <path/to/command> with the complete absolute path to the command. You can also limit the user to only performing a command with specific options and arguments by adding those options after the command path. If you do not specify any options, the user can use the command with all options.

   • To allow two and more commands on the same host on one line, you can list them separated by a comma followed by a space.

     For example, to allow user1 to execute the dnf and reboot commands on host1.example.com, enter user1 host1.example.com = /bin/dnf, /sbin/reboot.

4. Optional: To receive email notifications every time the user attempts to use sudo privileges, add the following lines to the file:

   Defaults    mail_always
   Defaults    mailto="<email@example.com>"

5. Save the changes, and exit the editor.

Verification

1. To verify if a user can run a command with sudo privileges, switch the account:

   # su <username> -

2. As the user, enter the command with the sudo command:

   $ sudo <command>
   [sudo] password for <username>:

   Enter the user’s sudo password.

3. If the privileges are configured correctly, the system displays the list of commands and options. For example, with the dnf command, it shows the following output:

   …
   usage: dnf [options] COMMAND
   …

   If the system returns the error message <username> is not in the sudoers file. This incident will be reported, the file for <username> in /etc/sudoers.d/ does not exist.

   If the system returns the error message <username> is not allowed to run sudo on <host.example.com>, the configuration was not completed correctly. Ensure that you are logged in as root and that the configuration was performed correctly.

   If the system returns the error message Sorry, user <username> is not allowed to execute '<path/to/command>' as root on <host.example.com>., the command is not correctly defined in the rule for the user.