3

System: macOS 14.6.1, M2 MacBook Air

I'm trying to use a regex pattern match in my suoders file. According to the man sudoers manpage as well as the online docs, that should be supported with sudo v1.9.10 or higher.

Running sudo --version on my system yields 1.9.13p2 so, should be ok there. Also, running the syntax check command below indicates that the file is being parsed successfully:

$ sudo visudo -c
/etc/sudoers: parsed OK

Here's an example line from my sudoers file which DOESN'T work:

luke  ALL=(ALL) NOPASSWD: /bin/launchctl asuser ^[0-9]+$ /usr/sbin/screencapture -D1 -p

And here's are two similar commands using regular wildcards/globs that DO work:

luke  ALL=(ALL) NOPASSWD: /bin/launchctl asuser ??? /usr/sbin/screencapture -D1 -p

luke  ALL=(ALL) NOPASSWD: /bin/launchctl asuser * /usr/sbin/screencapture -D1 -p

I've done as much debugging as I can but remain flummoxed. Anyone got thoughts?

Improve this question
0

1 Answer 1

Reset to default
5

From the sudoers(5) man page:

Command line arguments can include wildcards or be a regular expression that starts with ‘^’ and ends with ‘$’.

This seems to mean that the whole argument string must be included in the regular expression, not just part of it. By contrast, any part of the argument string can be replaced by a shell wildcard.

In your case, this would be

luke  ALL=(ALL) NOPASSWD: /bin/launchctl ^asuser [0-9]+ /usr/sbin/screencapture -D1 -p$
Improve this answer
5
  • 1
    Not sure your interpretation of the man page is correct, I would read it as „each argument can be a regex within ^$. Did you actually try this?
    – nohillside ♦
    Commented Aug 27 at 19:52
  • 3
    @nohillside Indeed. Very ambiguous wording (and implementation, imo). But, I did test Linc's answer and—it works!
    – luckman212
    Commented Aug 27 at 20:13
  • @luckman212 one learns something new every day. Thanks for confirming.
    – nohillside ♦
    Commented Aug 27 at 20:57
  • Seems like the invalid form should have failed the syntax check.
    – Linc Davis
    Commented Aug 27 at 21:07
  • 1
    visudo's job is just to ensure that sudo can be executed. It is not (and cannot) be responsible for the logic encoded by a rule. The syntax is fine; the OP's original intent just matched a command-line that wouldn't reasonably be used by a caller of launchctl.
    – chepner
    Commented Aug 28 at 13:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .