My team needs to install and administer a very big application on Red Hat 5.7, and needs to be able to do so as root. During the project, the Unix support team (which is responsible for the OS support) grants us (the application support team) sudo all access so we can do so. However, our internal policy dictates that once the server has been operationalized (becomes officially supported by our Unix team and goes live), that nobody but them should have root access.
To be able to definitely support the application in question, my team would need to provide a complete list of commands and access requirements to the Unix team so they can grant us sudo access to all those commands individually. The vendor of the application does not support this type of restrictive administration and does not have a defined recipe to properly do this without issues. It will pretty much be trial and error.
That said, what would be the best method to list all the required commands we would need to run, and to list every directory/file access we will need?
The application being installed as root, all files under its installation directory are currently owned either by root or by the service user (user created for the application's service).
I have started by listing all files with perms u+x, and came up with a stunning count of 2801 files after a base, unmodified installation. That's excluding init scripts in /etc/init.d, and other system commands (such as chown, chmod, ps, kill etc...) that we may have to run as well.
To me, it sounds almost impossible (or at least extremely difficult) to do this without encountering problems later. I understand this is not an easy question and that there could be many ways to do this, but I would nevertheless like to hear the community's take on this.