Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hy, a friend and me want to share a Linux-Machine. We both need to get root-rights via sudo for administering that machine. Is it somehow possible to deny the access to the home-folder for the other one, although he can become root?


share|improve this question
up vote 3 down vote accepted

Only with something like SELinux.

share|improve this answer
...and what user account has the right to modify the SELinux rule set? – andol May 16 '10 at 22:41
A root account with the appropriate role. Simply make it impossible for <friend> to acquire that role. – Ignacio Vazquez-Abrams May 16 '10 at 22:50

You could install encrypted home directories. This page has a writeup on how to install under Ubuntu.

share|improve this answer
This only protects the data from being mounted for reading. If the encrypted volume is mounted and both users have root access, they can both read the files within. – obfuscurity May 17 '10 at 0:23

you could restrict/deny access to /bin/su and other methods of obtaining 'full' root access on the machine. also, you can restrict /what/ can be run with root privileges, for certain users in /etc/sudoers and enable full logging of things executed with sudo


Defaults        logfile=/var/log/sudolog
userA     ALL = (root) /bin/ls, \
                       /usr/bin/apt-get update,  \
                       /usr/bin/vim /etc/*, \
                       !/usr/bin/su *root*

and so on. you can provide the exact commands you want your friend to be able to use, including the command line parameters, if you want to lock it down further (like with apt-get in my example)

you basically need to figure out /what/ he needs root access for, and dole it out sparingly. or learn to trust him.

two additional examples; vim /etc/* allows the user to edit anything in /etc/ as root, and the last one denies access to su (just as an example, since no access to su is implied, anyhow. , the man 5 sudoers in web form, has lots of examples to pick over.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.