How can I block a user not to use "sudo su -" command ? Because that will give him root access anyway. I want to limit him to read only permission for all files apart from what ever I give write access.
If you want a user to have
sudo permission for other commands, but not to be able to log in as root, you need to edit the
visudo file and specify the access you want the user to have.
Then inside that file you would define the user and give permissions based on what you want that user to be able to do, for example
test ALL=(ALL:`/home/test/) /home/test/, /usr/bin/vi, !/usr/bin/su
The above states that user test is allowed to access their home directory, run
sudo (as root) but nothing else. I am also explicitly telling the sudoers file to not allow the user to run
You should take a moment and read the sudoers manual, it explains everything.