Cfrtjryk

Here is a script:

#!/bin/bash



user='my_sudo_user'

sudo -lU $user

I was trying to limit my non_sudo_user to have the ability to run this script. Using visudo, I tried:

non_sudo_user ALL=(ALL) NOPASSWD: /bin/bash /full/path/script.sh

non_sudo_user ALL=(ALL) NOPASSWD: /usr/bin/sudo -lU

non_sudo_user ALL=(ALL) NOPASSWD: /usr/bin/sudo -lU *   # unsafe

None of them work. I get this message:

Sorry, user non_sudo_user is not allowed to execute 'list' as my_sudo_user on host123.

But I provided -l in sudoer file.

What can I do? This is Ubuntu by the way.

EDIT:

I actually run this script:

for u in $(awk -F'[/:]' '{if($3>=1000&&$3!=65534) print $1}' /etc/passwd); do sudo -lU $u ; done

So I don't have a definite list of users ahead of time.

EDIT:
complete rewrite after OP provided more information.

Specify the user in /etc/sudoers as having permission to execute /usr/sbin/sudo.

This will allow them to execute the sudo command, but they will have no permissions to run any other commands.

I just tested this on CentOS-7.3.1611 with a brand new user account:

testusr ALL=(ALL) NOPASSWD: /usr/sbin/sudo

I do not know if there are any security implications of specifying the sudo command itself in the list of allowed commands
Please review and test before you rely on this in a production environment...it may be insecure.

I think you can only list the commands a different user can run if you can run arbitrary commands as (ALL) that user. So instead...

In sudoers:

non_sudo_user ALL=(ALL) NOPASSWD: /usr/bin/sudo -l

And to list them, running as non_sudo_user:

for target_user in user1 user2 user3... ; do

    sudo -u "$target_user" sudo -l

done