Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I provide sudo access for a user, but restrict them to only editing of files, and only files that are under a nominated directory. For example, I would like the userabc to be able to edit all files in /var/www/vhosts/hostabc/ and it's children.

Thanks, Jonathan

share|improve this question

3 Answers 3

Or, to extend mattdm's suggestion, don't forget that sudo can be used to grant access to users other than root. You could create a custom user just for this purpose, chown -R customuser:customgroup /var/www/vhosts/hostabc, then give userabc sudo privileges to the customuser user. The user isn't used for anything else, so it's reasonably safe to do.

You also don't have to worry about using chmod +S to ensure inheritance, since the edits will be being done as the customuser user.

share|improve this answer

You can use sudoedit:

%editors_group ALL=(root) sudoedit /var/www/vhosts/hostabc/*

And add all editors to editors_group

share|improve this answer
    
doesn't that give all the users in editors_group full root access though? –  phalacee Nov 29 '10 at 3:10
    
Nope. It only gives access to edit files as root. But you can strengthen the security by using a different user in sudo and as owner of the files. Please read the manual: linux.die.net/man/8/sudoedit –  Mircea Vutcovici Nov 29 '10 at 3:34

It looks like there's no straightforward way. An old mailing list post implies that such a feature was discussed a few years ago, but a look at the current changelog shows that the post's pessimism is right, and nothing ever came of it.

Can you change the group ownership of those files? If you can, you can use chmod g+S /var/www/vhosts/hostabc, and then new files will also get that group. Alternately, and perhaps better although less transparent, you could use ACLs. These approaches would let you avoid using sudo at all.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.