非sudoer权限下执行ip、arp命令的解决方案咨询

Hey George, great question! This is a really common scenario when working with maintenance tools that need just enough elevated access to handle network configs without full root privileges. Here's the go-to solution:

The key is to grant your maintenance program's user limited sudo access specifically for the ip and arp commands—no full root rights required. Here's how to set it up safely:

• First, log in as root (or use sudo su to switch to root), then open the sudoers configuration file with the visudo command. Never edit /etc/sudoers directly—visudo checks for syntax errors before saving, which prevents you from breaking sudo entirely.
• Scroll to the bottom of the file and add a rule tailored to your setup:
  • If your maintenance program runs as a specific user (say, maintain_user), add this line:

    maintain_user ALL=(ALL) NOPASSWD: /usr/sbin/ip, /usr/sbin/arp
    

  • If you're managing a group of users/programs, use a group prefix (like %maintain_group for a group named maintain_group):

    %maintain_group ALL=(ALL) NOPASSWD: /usr/sbin/ip, /usr/sbin/arp
    

  • Important: Double-check the absolute paths of ip and arp first with which ip and which arp—some systems might have them in /sbin instead of /usr/sbin, so use the path your system returns.
• Save and exit the file (in visudo, that's :wq for Vim-style editing, or follow the on-screen prompts if you're using nano).

Once this is set up, your maintenance program can run the commands with sudo prepended (e.g., sudo ip addr add 192.168.1.100/24 dev eth0 or sudo arp -s 192.168.1.1 00:11:22:33:44:55) without needing to enter a password, and it won't have access to any other root-level commands.

I'd recommend testing this first by switching to the maintenance user and running the commands with sudo to make sure everything works as expected.

备注：内容来源于stack exchange，提问作者George Y