sudo to fully switch to another user

Hi,

Let’s suppose the following entry:

“”"
%test-sourceusers ALL = (%test-runas) NOPASSWD: /bin/ls, /bin/su -, /bin/bash
“””

ls is working without problem.

What i am not able to accomplish is to became any of the user in %destusers, with its default shell and changing the PWD.

Listing the users with “/bin/su - any_user_in_the_group” would result in a failure because i need to have a dynamic rule.

Logs:
“”"
root@build-jessie-amd64:~# getent group test-sourceusers
test-sourceusers:x:1003:daniele
root@build-jessie-amd64:~# getent group test-runas
test-runas:x:1001:nagios,testdestuser
root@build-jessie-amd64:~#

daniele@build-jessie-amd64:~$ sudo -u testdestuser /bin/ls /
bin  boot  dev  etc  home  initrd.img  lib  lib64  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var  vmlinuz
daniele@build-jessie-amd64:~$

daniele@build-jessie-amd64:~$ sudo -u testdestuser /bin/bash --login
testdestuser@build-jessie-amd64:/home/daniele$ pwd
/home/daniele
testdestuser@build-jessie-amd64:/home/daniele$

testdestuser@build-jessie-amd64:/home/daniele$ logout
daniele@build-jessie-amd64:~$ sudo -u testdestuser /bin/su - testdestuser
Password:
“””

The above is not filling my use case because:
- /bin/su will run effectively as the destination user (not root), asking the password, which is not known/does not exists
- /bin/bash is an example hardcoded shell. Sometimes shell kind cannot be guessed (csh, ksh, ...)
- cwd does not change upon running the shell, even if with shell run with --login, as by https://bugzilla.sudo.ws/show_bug.cgi?id=797

Is there another way to fully switch user that i am missing?

If not, worth the case to create a specific entry in Sudo to allow this behavior, without a password or with the password of the source user?

Thank you very much,
Daniele

____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users

-----BEGIN PGP SIGNATURE-----

iF0EARECAB0WIQQ2i6u6VhCxV1aSkPHxOPmZ9ILUVAUCWiia3wAKCRDxOPmZ9ILU
VOBmAJ4q6NBdqbw0j4dGw6IqklBApLGnzwCfbgl/rPVYuhpnVmKIOWi+6yZFPSY=
=jrye
-----END PGP SIGNATURE-----