Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to edit the sudoers file so a user can use sudo for any command except for a specified one? I reverse is true, I believe, that the sudoers file can be setup so that a user can only execute a given list of commands.

EDIT: the commands I really want to take away are halt and reboot... this makes me think there are special system calls for halt and reboot. Can you take system calls away from a user? If not, is it because the unix permission system abstracts over system calls neglecting this?

share|improve this question

9 Answers 9

up vote 4 down vote accepted

Another way to look at it is that if the users have largely unrestricted root access they can easily gain full root access.

While you might be able to work something out it would be easily circumvented.

SElinux though is a possible way, although it does take a lot to learn.

share|improve this answer

To do what you want (keep the user form running halt, reboot and shutdown), you're going to have to look into SElinux stuff to prevent the user from making those syscalls. Otherwise the user will just run /bin/sh first and then run /bin/halt without going through sudo.

share|improve this answer
1  
Or any one of a zillion programs you can get a shell from, or their own scrip. –  Ronald Pottol Jul 7 '09 at 3:36

Log everything they do via sudo, presumably, you have some way to get the point across to not do it again.

Defaults logfile=/var/log/sudolog 

will log all commands they run, google a bit for more info.

share|improve this answer
    
You will need centralized logging and you will need to shout at them if they run a shell. A shell can be gained from an editor for example. or man man etc. –  James Jul 7 '09 at 8:01

Yes and no... You can prevent a user from running a specific file by preceding the file with a bang (!), however you cannot stop a user from copying the file to another location and then running it from there.

User_Alias    ADMINS = peter, bob, bunny, %operator

ADMINS        ALL    = !/usr/bin/su, !SHELLS

Granting Access to Specific Files as Another User

share|improve this answer
    
Example of the how to set the "SHELLS" above: Cmnd_Alias SHELLS= /bin/sh, /bin/ksh, /bin/bash, /bin/zsh, \ /bin/csh, /bin/tcsh, \ /usr/bin/login, /usr/bin/su –  pulcher Jul 7 '09 at 2:43

If the user really wants to reboot, he will find a way. sudo -s, sudo -i, sudo $EDITOR /etc/sudoers... can be used to remove your restrictions.

And on Unix-like systems you are allowed to reboot the system as long as you're root (uid 0). If you do find a way to restrict those system calls, one could do this:

user$ echo b | sudo tee /proc/sysrq-trigger

or a variation thereof. Or reboot by causing a kernel panic. Or...

Finally, having root access usually gives you the ability to remove whatever restrictions are in place.

share|improve this answer
    
It sucks that Linux no longer has securelevels. They weren't perfect, but man were they easy to set up. They didn't prevent reboot, but prevented a lot of other stuff. And since they were so easy you could use them on all systems. No tweaking and such needed. –  Thomas Jul 7 '09 at 8:41
    
Weren't they in BSD, not Linux? –  grawity Jul 7 '09 at 9:24

sure, as root call visudo and prevent 'user' from running /sbin/halt:

user ALL=(ALL) NOPASSWD: !/sbin/halt
share|improve this answer
    
I believe that the request was for a list of commands that the user is NOT allowed to run –  Wayne Jul 7 '09 at 2:39
    
thanks, I forgot the ! in front of the command :-/ –  ThorstenS Jul 7 '09 at 2:53

There is a risk in doing this way: there are often may ways to do the same action. For example, telnit 6 or init 6 does a reboot too. There might be a way to force the kernel to core dump and reboot too.

share|improve this answer

The following line should let the user "jim" run everything but /usr/bin/kill and /usr/bin/su.

jim          ALL= !/usr/bin/kill,!/usr/bin/su
share|improve this answer

This is untested and YMMV but what about setting up a cmd_list of the commands you dont want run and then use !cmd_list for the specified group/user?

I dont have access to test this and just looked at the manual page online at Sudoers Manual so some experts will correct me here if I am wrong

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.