understanding sudoers

Question

I have a unix script which creates a temporary log file, say tempfl.log. When this file is created it has permission rw-r--r--.

There is a line

chmod 0440 /etc/sudoers tempfl.log 2>&1

But when the script is done the permission changes to r--r--r-- but it should be rw-r--r--. If I change the line to

chmod 0644 /etc/sudoers tempfl.log

the permissions are right for tempfl.log but it throws errors saying

sudo: /usr/local/etc/sudoers is mode 0644, should be 0440

I do not understand what sudoers is doing and what is wrong.

Answer 1

When you write chmod 0440 /etc/sudoers tempfl.log it changes the permissions of /etc/sudoers and tempfl.log to both be 0440, which is wrong.

When you write chmod 0644 /etc/sudoers tempfl.log it changes the permissions of /etc/sudoers and tempfl.log to both be 0644, which is wrong.

Do you need to change permissions on /etc/sudoers at all? Did you actually want to write chmod 0644 tempfl.log?

Answer 2

Your script is doing exactly what you're telling it to do:

chmod 0440 /etc/sudoers tempfl.log

will apply r--r----- to both of those files.

You really shouldn't be fiddling around with the sudoers file unless you're writing admin scripts and, even then, the permissions should be left alone since that helps secure your system. The sudo program itself checks the permissions of its configuration file and warns you (as you've seen). Listen to it. It obviously knows better than you :-)

Are you sure you aren't just trying to run certain parts of your script under sudo, as in:

sudo chmod 0440 tempfl.log 2>&1

If not, and you really want to modify both files (but with different permissions, use two separate commands:

chmod 0440 /etc/sudoers 2>&1
chmod 0644 tempfl.log 2>&1

Answer 3

Your script is changing the permission of 2 files, /etc/sudoers and tempfl.log. Split the command in two lines and you should be fine.