Hi Corona

The Key point here I was not aware of is that SUDO does not inherit shell options like -x. That helps thanks.

Since I do not have root access to modify /etc/sudoers at work I tested this out on my Mac Pro that runs underlying OS Darwin 10.8 BSD/OSX based Linux.

First as root I added the following entry to /etc/sudoers so that user 'otheruser' has sudo permission to run the command owned by admin account. Note that on Mac OS, in addition to admin there is also root user.

Code:

otheruser ALL=(ALL) NOPASSWD: /Users/admin/test_xtrace_withsudoaccess.ksh

As admin user 'admin' I created the following files which have no read/execute permission to group and others

Code:

$ cat testenvfile.txt 
export ADMINHOMEDIR="/Users/admin"

Code:

$ cat test_xtrace_withsudoaccess.ksh 
#!/bin/ksh
. /Users/admin/testenvfile.txt

Then I created following script with 'otheruser' which just sources above admin script without using Sudo

Code:

$ cat call_adminusers_restrictedsudocommand.ksh 
#!/bin/ksh
set -x
. /Users/admin/test_xtrace_withsudoaccess.ksh

Obviously it fails like below due to no read/execute permission

Code:

$./call_adminusers_restrictedsudocommand.ksh 
+ . /Users/admin/test_xtrace_withsudoaccess.ksh
./call_adminusers_restrictedsudocommand.ksh[3]: .: /Users/admin/test_xtrace_withsudoaccess.ksh: cannot open [Permission denied]

Then I updated this 'otheruser' script to use sudo instead of directly calling it as below

Code:

$ cat call_adminusers_restrictedsudocommand.ksh 
#!/bin/sh
set -x
sudo /Users/admin/test_xtrace_withsudoaccess.ksh

Now when I invoked this script by 'otheruser' I got the following output which shows that even though the admin script got execute fine, envfile.txt contents are hidden as sudo does not inherit -x oiption

Code:

$./call_adminusers_restrictedsudocommand.ksh 
+ sudo /Users/admin/test_xtrace_withsudoaccess.ksh

On the other hand when I used xtrace option set -x within a script owned by 'admin' user as below, where it invokes the script directly without using sudo, the xtrace output prints the entries of the envfile.txt as they are parsed

Code:

$ cat call_testxtrace.ksh 
#!/bin/ksh
set -x
. ./test_xtrace_withsudoaccess.ksh

Output

Code:

$ /Users/admin/call_testxtrace.ksh 
+ . ./test_xtrace_withsudoaccess.ksh
+ . /Users/admin/testenvfile.txt
+ ADMINHOMEDIR=/Users/admin
+ export DMINHOMEDIR

So this proves your theory that sudo doesnot inherit -x option meaning a secure script owned by admin that sources a secure env file, can be granted sudo access to other users without the risk of those user being able to trace envfile contents with the Xtrace option.


Thanks
waavman