Continuing our Sudo policy series, we’re going to focus on the Runas_Alias label this week. In many regards, this looks much like the User_Alias in that it takes users and groups and the syntax is the same.
However, its purpose is much different. Where the User_Alias identifies who CAN run this policy entry, the Runas_Alias defines which users and groups the policy may be executed under.
The typical default entry for this (much like the Host_Alias label) is “ALL” which allows the command to be executed under any user or group identified by the calling user.
Typical sudo calls look like this:
sudo my_command
This defaults to calling “my_command” as the root user. The policy probably had “(ALL)” as the Runas_Alias label, as mentioned above. We don’t always want to let a user run a command as root, though. Sometimes we want to allow one user to call a command as another non privileged user, just because that process belongs to that user. To do this, we set a Runas_Alias label that restricts the command to being executed under that user, not root, and not “ALL.”
With such a policy in place, the user has to know how to call sudo to execute under someone other than the default “root” user. The “-u” flag allows this.
sudo -u otheruser my_command
Sometimes, we also need to call the command as a different group. In order to do this, we can pass the “-g” flag. A combination of both is valid.
sudo -u otheruser -g othergroup my_command
This allows for more granular control over the policies being written, and enforces safe policy that doesn’t grant access to root except when absolutely necessary.
This is the end goal of any good policy. Only allow what is strictly necessary, and nothing more than that.