NAME

subst_sudo_user - Sudo helper program

SYNOPSIS

subst_sudo_user <COMMAND> [<ARGUMENTS>]

Substitute literal $SUDO_USER in the ARGUMENTS and run COMMAND.

RATIONALE

It enables sys admins to define sudoers(5) rule in which each user is allowed to call a privileged command with thier own username in parameters. Example:

  %users ALL=(root:root) NOPASSWD: /usr/tool/subst_sudo_user passwd $SUDO_USER

This rule allows users to run subst_sudo_user (and subsequentially passwd(1)) as root with verbatim $SUDO_USER parameter. So no shell variable resolution happens so far. Subst_sudo_user in turn, running as root, replaces $SUDO_USER to the value of SUDO_USER environment variable, which is, by sudo(1), guaranteed to be the caller username. Then it runs passwd(1) (still as root) to change the given user's password. So effectively with this rule, each user can change their password without knowing the current one first (because passwd(1) usually does not ask root for his password).

EXAMPLES

  %USERS ALL=(root:root) NOPASSWD: /usr/tool/subst_sudo_user /usr/bin/install -o $SUDO_USER -m 0750 -d /var/backup/user/$SUDO_USER