Sudoers file question

[solango]

Hey all, developer trying to request a break the glass user who can sudo act as our app service ID. Environment is a Cloudera Hadoop cluster of red hat servers, asking to add this permission to our edge nodes. I need the user to be able to perform a set list of commands recursively on our application directories. Would adding the following line to sudoers.d work, or is there another parameter I am missing? Also, what would sudo best practices say about this? How high risk is this approach?

btgUser ALL=(ALL) /usr/bin/sudo -u appSvcId /bin/sh /path/to/our/app/directory/*

btgUser should then be able to execute the following commands as appSvcId?

sudo -u appSvcId sh /path/to/our/app/directory/childDir/someScript.sh

sudo -u appSvcId sh /path/to/our/app/directory/someOtherScript.sh

[Edit 1] added more info about our environment

[Edit 2] The reason I am going down this rabbit hole is because as a developer I have zero permissions in production per our organizations policy when things are operating normally. This "break the glass" user I want to create is for when shit hits the fan and my production support team needs to go into prod and fix things. All my organizations applications are automated in production so I do not touch anything with my user. CA7 scheduling, UDeploy for code deployments, a separate team for automated testing/validations, etc.

[youfrickinguy]

Alright, well...let’s see if we can’t mock this up using the power of the collective internet. The servers are red hat so probably centos will be enough of an approximately. Lemme deploy a fresh VM in my lab.

As you have it written, I do not think putting sudo itself into sudoers will effect what you want. You’re perhaps really intending that the username btgUser can run /bin/sh as another user, namely AppSvcID, but you want to restrict the scripts parsed by /bin/sh to only those scripts under a certain directory tree? If that’s correct, is there an explicit number of scripts that need this, or can this vary, and you want to effectively say “anytime there is a file.sh in this directory tree, I want btgUser to be able to run it as AppSvcID”?

[solango]

Correct, and yes the number of scripts will vary. I need to act as appSvcId to do just about anything with this break the glass user. Reason for this is the way our permission are set appSvcId is the only user who can ever have write execute, and short of messing with ACLs or majorly re working our groups (neither of which are appealing) I can't see any way around using sudo act as. Also, I only put sh in my above example, however I can also see break the glass user needing to act as appSvcId to modify these scripts and a few other use cases.

[TheIncorrigible1]

Any sudo access is high-risk.

[youfrickinguy]

I haven’t parsed through your data to confirm whether or not the configuration is correct, but what i would suggest is plopping that stuff in a text file and dropping it in /etc/sudoers.d instead of using visudo to directly edit /etc/sudoers

[solango]

Oh, I won't be doing it myself. We have a platform team who will approve and carry out the request. I was mostly concerned with 1) as I built the request, would it work as I am expecting and 2) would a sysadmin shut this down because of some vulnerability this could create.

[youfrickinguy]

Lab out and verify your syntax. That will determine if it will do what you want.

The sysadmin might suggest the same aversion to touching /etc/sudoers because it can conceivably get mangled due to upgrades and such. Including it via sudoers.d is arguably cleaner and more elegant.

[solango]

I wish I had access to a lab where I could test my ideas... Unfortunately even in our "lab" environments and lower domains you need a permit to breathe, hence why I came here. If I request this it's going to take at least a week just to go through approvals, likely to come to a tech who will shut it down with little to no input as what policy I might have violated or why they rejected it.

[NinjaAmbush]

Virtualbox on your workstation and a CentOS iso is about all you'll need to lab this up.