4

How would I add flags and/or arguments to allow users in the sudoers file to run certain parts of commands, such as only allowing a user to run sudo rm and not sudo rm -rf? I am using 14.04. 

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults    env_reset,pwfeedback
Defaults    mail_badpass
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL
Ruby    ALL=/usr/bin/apt-get update,/usr/bin/rm,/usr/bin/rmdir,/usr/bin/mkdir

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d
Improve this question
8
  • 2
    I do not think you can have that fine grain of control over the commands directly. You can make a script, owned by root, in /usr/local/bin and give sudo to that. your_command -your_options @ , just test the input.
    – Panther
    May 22, 2015 at 14:26
  • 4
    Say you block rm -rf. What's to prevent rm -f / -r?
    – muru
    May 22, 2015 at 14:34
  • 3
    Please explain the problem you have and not the solution you believe you need to apply. What you want here is not possible and the reason for it is because this method would be full of holes (as @muru already posted).
    – Rinzwind
    May 22, 2015 at 14:56
  • 1
    Good answer :P @Rinz see response`
    – Tim
    May 22, 2015 at 16:27
  • 1
    @alex ah good to know. What works is a "whitelist" -but- the fact you let that person use sudo is the problem: for instance a cp can be an used as an equivalent to rm making your rm fix in the sudoers file useless. If this would have been related to for instance updating /var/www/ for apache there are better methods (that is one example people need access outside their home).
    – Rinzwind
    May 22, 2015 at 16:43

1 Answer 1

Reset to default
1

As stated in the comments, there isn't a way to control sudoers in the way requested, although there are fine grained permissions available in the system:

https://help.ubuntu.com/community/FilePermissionsACLs

But even that isn't quite enough, you'd basically have to replace all the standard program libraries with scripts to filter flags. Which would be messy and potentially break the system.

Instead consider flipping the problem and creating users who don't need sudoers. Making sure they're in the right groups and using ACLs to expand permissions where needed so they can access the files they need without causing issues.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.