Specify command with quoted arguments in sudoers?

Question

The General Case

I'm trying to enable a user to run a sudo command (with arguments) without a password. I can get the NOPASSWD directive to work, but only when the arguments don't contain quotation marks.

For example, this works:

# /etc/sudoers.d/sample
%sudo   ALL=(ALL)  NOPASSWD: /bin/echo foo

$ sudo echo foo
foo

But this doesn't, because quotation marks are interpreted literally:

# /etc/sudoers.d/sample
%sudo   ALL=(ALL)  NOPASSWD: /bin/echo "foo"

$ sudo echo "foo"
[sudo] password for rlue:
$ sudo echo \"foo\"
"foo"

---

My Specific Case

This is the command I'm trying to allow:

$ sudo sh -c 'echo XHCI > /proc/acpi/wakeup'

I actually got it to work with the following unquoted command:

%sudo   ALL=(ALL)  NOPASSWD: /bin/sh -c echo XHCI > /proc/acpi/wakeup

But since it calls out to sh -c, and since I clearly don't understand precisely what's going on, I'd like to be extra explicit about what I'm allowing.

How can I specify quoting for command arguments in the sudoers file?

Solution

edit: Warning, it appears that sudo does not safely handle spaces in the command, so it is not safe to use sudo in this way. https://unix.stackexchange.com/a/279142/39281

Instead of using quotes in the sudoers file, you can escape spaces using backslash:

%sudo   ALL=(ALL)  NOPASSWD: /bin/sh -c echo\ XHCI\ >\ /proc/acpi/wakeup

You can still use it as follows, because the user's shell handles the quoted argument anyway:

sudo /bin/sh -c 'echo XHCI > /proc/acpi/wakeup'

You could also consider putting a complex command into a script, as suggested in a comment. https://serverfault.com/a/516002

Comments

[Ryan Lue]

Sure, but for example, mv this that the other is different from mv this that 'the other', and the unquoted syntax permits both. How can I be sure I haven't missed any edge cases?

[Ryan Lue]

This appears semantically identical to not having backslashes (that is, the arguments can still be grouped with quotation marks in every possible arrangement).

[Sam Watkins]

Someone commented: there's an other QA telling this is possibly unsafe: unix.stackexchange.com/questions/279125/… then removed their comment. But they were right, it is unsafe, seems like sudo is not safe to be used when there are spaces in the command name. Perhaps I am misusing it, or perhaps it is a rubbish insecure tool. If it is so easy to misuse, I suggest the latter.