4

How would I add flags and/or arguments to allow users in the sudoers file to run certain parts of commands, such as only allowing a user to run sudo rm and not sudo rm -rf? I am using 14.04. 

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults    env_reset,pwfeedback
Defaults    mail_badpass
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL
Ruby    ALL=/usr/bin/apt-get update,/usr/bin/rm,/usr/bin/rmdir,/usr/bin/mkdir

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d
|improve this question
  • 2
    I do not think you can have that fine grain of control over the commands directly. You can make a script, owned by root, in /usr/local/bin and give sudo to that. your_command -your_options @ , just test the input. – Panther May 22 '15 at 14:26
  • 4
    Say you block rm -rf. What's to prevent rm -f / -r? – muru May 22 '15 at 14:34
  • 3
    Please explain the problem you have and not the solution you believe you need to apply. What you want here is not possible and the reason for it is because this method would be full of holes (as @muru already posted). – Rinzwind May 22 '15 at 14:56
  • 1
    Good answer :P @Rinz see response` – Tim May 22 '15 at 16:27
  • 1
    @alex ah good to know. What works is a "whitelist" -but- the fact you let that person use sudo is the problem: for instance a cp can be an used as an equivalent to rm making your rm fix in the sudoers file useless. If this would have been related to for instance updating /var/www/ for apache there are better methods (that is one example people need access outside their home). – Rinzwind May 22 '15 at 16:43
1

As stated in the comments, there isn't a way to control sudoers in the way requested, although there are fine grained permissions available in the system:

https://help.ubuntu.com/community/FilePermissionsACLs

But even that isn't quite enough, you'd basically have to replace all the standard program libraries with scripts to filter flags. Which would be messy and potentially break the system.

Instead consider flipping the problem and creating users who don't need sudoers. Making sure they're in the right groups and using ACLs to expand permissions where needed so they can access the files they need without causing issues.

|improve this answer

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.