mjhjmtu

I'm having a bit of trouble with sudoers syntax. Long story short, I'm struggling with my graphics card and I recently found out that I can turn it on and off with a simple command (previously it was always off, which is good 90% of the times, but sometimes I'd like to use its extra power sometimes). My idea is to use these two commands in various script to turn on the GC, execute a command that uses the GC and then turn it off, something like this:

sudo tee /proc/acpi/bbswitch <<<ON
optirun [command]
sudo tee /proc/acpi/bbswitch <<<OFF

Problem is, these script are very rarely executed in a shell, they are mostly executed by double-clicking on the .sh file. So I looked into how to avoid password for specific sudo commands and found out about sudoers.

I executed visudo and added a line at the end of the file:

grb ALL=(ALL) NOPASSWD: tee /proc/acpi/bbswitch <<<OFF, tee /proc/acpi/bbswitch <<<ON

but as soon as I close the editor, visudo says there is a syntax error, but nothing more. The syntax error is raised even if I add only one command:

grb ALL=(ALL) NOPASSWD: tee /proc/acpi/bbswitch <<<OFF

This line was added as the last and it's the first time that I edit the sudoers file.

If it's useful, I'm using Ubuntu MATE 18.04. I suspect the answer is really simple, but I can't find any documentation specific enough for my case. I want to stress that I need to limit the possible inputs to /proc/acpi/bbswitch to ON and OFF, I don't know what happens if I write something different and judging from the amount of troubles my GC gave me it will probably be something bad. I have to know that if I'm asked a password or the program doesn't start, I have to check that the switch commands are written correctly.

A redirection is not part of the actual command. It's just an instruction to the shell to arrange the plumbing for standard input and output in certain ways before actually running the command.

Therefore, it makes no sense to include the <<< "here-string" redirection in the command in the sudoers file.

Instead, since you'd like to restrict the use to only allowing the strings ON or OFF to be written to /proc/acpi/bbswitch, you could make a script like this:

#!/bin/sh

case $1 in
 ON) ;; # nothing
 OFF) ;; # nothing here either
 *) printf 'Usage: %s ON|OFFn' "$0" >&2
 exit 1
esac

printf '%sn' "$1" >/proc/acpi/bbswitch

You would then put this in a directory where the required users could access it, but not modify it, and allow them to use it with the ON or OFF command line argument, e.g.

grb ALL=(ALL) NOPASSWD: /some/path/script.sh ON, /some/path/script.sh OFF

(or something similar)