I want to disable a user to edit sudoers file, so I added a line in sudoers file:

Cmnd_Alias BLOCK = !/usr/sbin/visudo, !/bin/nano /etc/sudoers

it blocks if a user tries to edit like this:

  sudo nano /etc/sudoers

but when he's enter to etc:

cd /etc
sudo nano sudoers

... he can use nano, and edit sudoers.

how can i solve this? thanks

  • 1
    That's not an effective way to manage security on your server, you should really make an effort to read this great book on sudo called Sudo Mastery by MW Lucas - tiltedwindmillpress.com/product/… – kingmilo Apr 2 '19 at 13:31
  • 4
    This feels like an XY problem. Could you explain what you're trying to accomplish here? Why does this user have sudo access in the first place? If you don't want them to have full access to your system, don't give them sudo access! And if they need it for specific commands, then allow only those commands. I don't think it will be possible to block them from editing a specific file. Even if you manage it, they could still run cp /etc/sudoers sudoers.copy, then make their changes in the copy and sudo mv sudoers.copy /etc/sudoers. – terdon Apr 2 '19 at 15:15

From my standpoint... if you don't want a user to be changing things as sudo, you should NOT be granting sudo access in the first place. This is for the same reason you don't give your bank account information to Nigerian prince scammers - if they have your information (or access) they will have access beyond what you probably want to grant the individual.

Giving sudo access in a way that lets them use any command except some commands ("blacklisting" commands) is MUCH harder to implement, and in fact the sudo and sudoers mechanisms are not really built to do this kind of blacklisting in a safe way.

Conversely, giving this hypothetical user sudo access for only some commands (and not all commands), by specifically specifying the things they can execute as sudo on the sudoers line, is the proper way to really do this type of restrictions with sudo ("whitelisting" commands instead of blacklisting them)

This said, if you REALLY want to go this route, then...

In the second method, he's not using the full path. The command blocks you've initiated here deny access when the command and arguments are identical matches. The utilities are unfortunately stupid and don't actually equate arguments passed in as fully qualified on-disk paths and need to be exact matches to what's being executed.

Add to the list such that you get this:

Cmnd_Alias BLOCK = !/usr/sbin/visudo, !/bin/nano /etc/sudoers, !/bin/nano sudoers

... however there are a trillion ways to circumvent this, so you really should be whitelisting access to commands rather than blacklisting commands that sudoers are not supposed to use.

| improve this answer | |
  • 1
    That's still kinda pointless though. The user could still cd /usr; sudo nano ../etc/sudoers or ln -s /etc/sudoers foo; sudo nano foo etc. And this would mean they can't actually edit /random/sudoers file either. – terdon Apr 2 '19 at 15:13
  • @terdon Therein lies the problem of giving sudo access. YOu really shoulnd't be giving users sudo access if you don't want them changing things. Ever. – Thomas Ward Apr 2 '19 at 15:18
  • 1
    @terdon Alternatively, only specify what commands they can run as sudo, which is the easier mechanism for restricting. – Thomas Ward Apr 2 '19 at 15:20
  • Yes, my thoughts exactly :) – terdon Apr 2 '19 at 15:48
  • 1
    @PerlDuck this is what I said in the first part of my answer ;P – Thomas Ward Apr 2 '19 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.