sudoers sudoedit recursive wildcard

Question

I want to allow editing any file (recursively) under specific directory via sudoers.

None of the below works (Debian 9 sudo)

ops ALL=(root) NOPASSWD: sudoedit /opt/myapps/
ops ALL=(root) NOPASSWD: sudoedit /opt/myapps/*
ops ALL=(root) NOPASSWD: sudoedit /opt/myapps/**
ops ALL=(root) NOPASSWD: sudoedit /opt/myapps/**/*

What is the correct syntax?

Answer 1

You could give the user access to the sudo group:

Here's how I setup a non-root user on Ubuntu 18.04:

groupadd -g 999 foobaz && useradd -u 999 -g foobaz -G sudo -m -s /bin/bash foobaz &&
sed -i /etc/sudoers -re 's/^%sudo.*/%sudo ALL=(ALL:ALL) NOPASSWD: ALL/g' &&
sed -i /etc/sudoers -re 's/^root.*/root ALL=(ALL:ALL) NOPASSWD: ALL/g' &&
sed -i /etc/sudoers -re 's/^#includedir.*/## **Removed the include directive** ##"/g' &&
echo "foobaz ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers &&
echo "Enabled passwordless access to the sudo group for the foobaz user!" &&
echo "foobaz user:";  su - foobaz -c id

What happens with the above code:

• The user and group foobaz is created.
• The user foobaz is added to the both the foobaz and sudo group.
• The uid and gid is set to the value of 999.
• The home directory is set to /home/foobaz.
• The shell is set to /bin/bash.
• The sed command does inline updates to the /etc/sudoers file to allow foobaz and root users passwordless access to the sudo group.
• The sed command disables the #includedir directive that would allow any files in subdirectories to override these inline updates.

Then you'll be able to run su foobaz, sudo -s, exit, etc.

---

If you want the short version, just run:

echo "foobaz ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

Beware that this will append to the existing /etc/sudoers file instead of properly updating the contents.