1

I want to prevent sudo from executing files not owned by root.

so, to allow sudo run such file, I want the file to be:
chown root:root filename
chmod go-w filename

Is it possible to limit sudo this way?

It should also be inherited by graphical sudo like runners (gksudo, kdesudo, ...), but I think it could be too much tricky, not sure tho.

4
  • I don't think that's possible on a system-wide basis. If the file in question is a shell script, then you can check the uid of the user running the file and if it's 0, then quit there. Mar 20, 2015 at 17:45
  • I'd say it is impossible, since pretty much any shell on the system is owned by root, as is chown itself, and editors like vim and emacs which can spawn commands, as well as commands like perl, awk and python, and so on...
    – muru
    Mar 20, 2015 at 17:58
  • @muru so you mean that even if I manage to allow only a root:root go-w file to be executed, it could still child a non secure script? :( Mar 20, 2015 at 18:42
  • 1
    @AquariusPower yep. The only way is careful whitelisting.
    – muru
    Mar 21, 2015 at 4:24

2 Answers 2

1

It's a genuinely interesting idea but not without issues.

You could add a "semiadmin" group (your choice on the name), put a user in that group instead of the "sudo" group, and then add /etc/sudoers lines using wildcards to match the common places root-owned commands live:

%semiadmin (ALL)=/usr/bin/*,/bin/*,/sbin/*

The problem with this approach is you would also need to prevent somebody using any editor (or visudo), or let them edit their user... If they can do that, they can elevate their privileges.

Simply put, it's much easier to specify exactly which commands you want them to use.
A list of commands you've sanitised for loopholes.

2
  • I see, so I also have to remove all users from group sudo (that are on it of course) right? very interesting, seems a good shield indeed; to reinforce it I found this: superuser.com/a/735286/157532; the sanitized list seems the best way in a sense that: keep admin stuff to admin to do. A few commands with limited parameters may be made available then, thx! Mar 20, 2015 at 19:01
  • Yeah, if you don't want people to have unlimited rights, kick them out of the sudo group.
    – Oli
    Mar 20, 2015 at 19:23
-1

Login as the owner of the file who is not root and revoke execution permission from other users using this command

chmod o-x filename
1
  • 2
    Sorry, but that's complete nonsense. -1
    – A.B.
    Mar 20, 2015 at 19:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .