1

I would like to edit /etc/sudoers so that group users can execute (only) /bin/chown as user dummy. How might this be done?

Improve this question
3
  • @Zoredache If they run chown as user dummy, they won't be able to change the ownership of /etc/sudoers.
    – Kyle Smith
    Mar 26, 2012 at 19:18
  • @KyleSmith, I guess I miss-understood what he was asking then. I thought he wanted to run run sudo to set ownership too the dummy user.
    – Zoredache
    Mar 26, 2012 at 20:06
  • This request seems a bit pointless as if chown is run on files as user dummy, only files that are owned by dummy could be changed maybe. Most of the modern kernels disallow chown by anybody but root to prevent things like quota evasion.
    – mdpc
    Mar 26, 2012 at 23:01

2 Answers 2

Reset to default
1

The chown command requires root privileges. It will not run as any other user.

You could restrict your command to only being able to change the ownership of files to the dummy user however, as Zoredache noted, this will still allow them to edit any file on the system. I don't know if sudo will work if /etc/sudoers is not owned by root but I'm certain that giving an untrusted user permission to edit any file on the system would be sufficient to give them a full root shell.

You will want to restrict which files the user can change the ownership of as well.

Better still, find a better way of achieving what you are trying to achieve here.

What are you trying to achieve here?

Improve this answer
2
  • You are right. I am attempting to make this work with chmod instead of chown. I have some files owned by "dummy" that should be inaccessible to anyone (including dummy, basically, since hes got no shell and no password and his account is expired). However if a user (group "users") needs to access such a file, they can run a script that lets somebody know and then makes a lockfile and does sudo -u dummy and changes file ownership -- make that permissions ...May be easier just to put these files in "users" group and setup a script that watches file access times or something.
    – dogglebones
    Mar 26, 2012 at 21:03
  • By the way I'd vote you up but my reputation precedes me.
    – dogglebones
    Mar 26, 2012 at 21:16
5

I'd suggest that you read almost all of man sudoers to gain a thorough understanding of what this does, but you want to do this:

%users ALL=(dummy) /bin/chown *
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .