Is there any way to allow user to execute commands for 2 days only
How to give a sudo command permission for a specific time? is there any way to give rights to perform a specific command for 2 days only in sudoers file.?
The sudoers file does not support time based restriction but there is an easy method. Create a file with your alterations in /etc/sudoers.d/
(with sudo visudo -f /etc/sudoers.d/yourfile
):
Add to a file (example: file.sh
) the following
mv /etc/sudoers.d/yourfile /etc/sudoers.d/.yourfile
And this will disable your alterations:
sudo at -f file.sh 2pm + 2 days
Example:
at -f file.sh 2pm + 2 days
warning: commands will be executed using /bin/sh
job 4 at Thu Oct 15 14:00:00 2015
In this case it would move the file over at 2 pm 2 days after you issue the command. The at
manual has some options (you can use a time, days, weeks, months, years, keywords like next or add/subtract periodes). Have some tests with the option to make sure you understand it (Something to consider: it matters if you start the at
before or after 2pm on the day itself.)
at
also survives reboots so is a good tool to use for these kind of things.
And you can toggle access ...
sudo mv /etc/sudoers.d/.yourfile /etc/sudoers.d/yourfile | at 2pm + 2 days
sudo mv /etc/sudoers.d/yourfile /etc/sudoers.d/.yourfile | at 2pm + 4 days
sudo mv /etc/sudoers.d/.yourfile /etc/sudoers.d/yourfile | at 2pm + 6 days
sudo mv /etc/sudoers.d/yourfile /etc/sudoers.d/.yourfile | at 2pm + 8 days
and make that user go nuts (wtf now I can do this).
The README in /etc/sudoers/
:
# As of Debian version 1.7.2p1-1, the default /etc/sudoers file created on
# installation of the package now includes the directive:
#
# #includedir /etc/sudoers.d
#
# This will cause sudo to read and parse any files in the /etc/sudoers.d
# directory that do not end in '~' or contain a '.' character.
#
# Note that there must be at least one file in the sudoers.d directory (this
# one will do), and all files in this directory should be mode 0440.
#
# Note also, that because sudoers contents can vary widely, no attempt is
# made to add this directive to existing sudoers files on upgrade. Feel free
# to add the above directive to the end of your /etc/sudoers file to enable
# this functionality for existing installations if you wish!
#
# Finally, please note that using the visudo command is the recommended way
# to update sudoers content, since it protects against many failure modes.
# See the man page for visudo for more information.
If I read this correctly it will not execute any file with a "." anywhere in the name. So the 1st mv
command I placed the "." in front making it also invisible. If correctly assumed you can place a "." anywhere. Careful with the "~", that one is used as a "backup" feature by editors like gEdit.
at
is not installed by default. To install
sudo apt-get install at