First off, visudo(8)
is just the recommended editor for the /etc/sudoers
file. Nothing else. It is so, because it does some syntax checking, and basic rules parsing in order to warn you if you are just about to shoot yourself in the foot. It is not perfect, but it has proven to be very helpful.
That said, the following lines show how to grant execution permissions on a not readable file, without using SETUID tricks. I have used root
and /root/bin/
, but this is true for any other scenario where the user who is granted execution permissions does not have read access to the file.
The #
symbol, as usual, means the commands are run by root
, the $
symbol marks the lines run by the unprivileged user:
# adduser foo
...
# id foo
uid=1002(foo) gid=1002(foo) groups=1002(foo)
# grep foo /etc/sudoers
Defaults:foo secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/root/bin"
foo ALL = (root) /root/bin/bar
# ls -lrt /root/bin/bar
-rwx------. 1 root root 38 Oct 4 20:22 /root/bin/bar
# cat /root/bin/bar
printf "Welcome to the Terrordome!\n"
# su - foo
$ id
uid=1002(foo) gid=1002(foo) groups=1002(foo)
$ sudo bar
Welcome to the Terrordome!
$ cat /root/bin/bar
cat: /root/bin/bar: Permission denied