I want to prevent sudo from executing files not owned by root.

so, to allow sudo run such file, I want the file to be:
chown root:root filename
chmod go-w filename

Is it possible to limit sudo this way?

It should also be inherited by graphical sudo like runners (gksudo, kdesudo, ...), but I think it could be too much tricky, not sure tho.

  • I don't think that's possible on a system-wide basis. If the file in question is a shell script, then you can check the uid of the user running the file and if it's 0, then quit there. – saiarcot895 Mar 20 '15 at 17:45
  • I'd say it is impossible, since pretty much any shell on the system is owned by root, as is chown itself, and editors like vim and emacs which can spawn commands, as well as commands like perl, awk and python, and so on... – muru Mar 20 '15 at 17:58
  • @muru so you mean that even if I manage to allow only a root:root go-w file to be executed, it could still child a non secure script? :( – Aquarius Power Mar 20 '15 at 18:42
  • 1
    @AquariusPower yep. The only way is careful whitelisting. – muru Mar 21 '15 at 4:24

It's a genuinely interesting idea but not without issues.

You could add a "semiadmin" group (your choice on the name), put a user in that group instead of the "sudo" group, and then add /etc/sudoers lines using wildcards to match the common places root-owned commands live:

%semiadmin (ALL)=/usr/bin/*,/bin/*,/sbin/*

The problem with this approach is you would also need to prevent somebody using any editor (or visudo), or let them edit their user... If they can do that, they can elevate their privileges.

Simply put, it's much easier to specify exactly which commands you want them to use.
A list of commands you've sanitised for loopholes.

  • I see, so I also have to remove all users from group sudo (that are on it of course) right? very interesting, seems a good shield indeed; to reinforce it I found this: superuser.com/a/735286/157532; the sanitized list seems the best way in a sense that: keep admin stuff to admin to do. A few commands with limited parameters may be made available then, thx! – Aquarius Power Mar 20 '15 at 19:01
  • Yeah, if you don't want people to have unlimited rights, kick them out of the sudo group. – Oli Mar 20 '15 at 19:23

Login as the owner of the file who is not root and revoke execution permission from other users using this command

chmod o-x filename
  • 2
    Sorry, but that's complete nonsense. -1 – A.B. Mar 20 '15 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.