How do I limit the users a specific user can run commands in linux?

Question

I have 2 user accounts, foo and bar

I want to allow user foo to execute commands as root and any other user ie:

sudo su root -c'./run-my-script'

sudo su bar -c'./another-script'

sudo su another -c'./yet-another-script

I also want to allow user bar to execute commands as other user but only a subset and not root ie:

sudo su bar -c'./run-my-script'

but not

sudo su root -c'./run-my-script'

Is this possible ?

Answer 1

Yes, it's certainly possible.

Firstly you need to fix your usage of sudo, to execute a command as a user other than root (the default) with sudo the syntax is: sudo -u username command

You can then lock down the users whose identity a user can assume via the /etc/sudoers config file, eg a fully privileged user looks like:

jim ALL=(ALL) ALL

Whereas a user with restrictions looks like:

jim ALL=(admin,bill) ALL

Which means if I try and execute a command as a user who isn't in the list I get denied:

jim@mybox:~$ sudo -u nobody whoami
Sorry, user jim is not allowed to execute '/usr/bin/whoami' as nobody on mybox.