Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to edit /etc/sudoers so that group users can execute (only) /bin/chown as user dummy. How might this be done?

share|improve this question
    
@Zoredache If they run chown as user dummy, they won't be able to change the ownership of /etc/sudoers. –  Kyle Smith Mar 26 '12 at 19:18
    
@KyleSmith, I guess I miss-understood what he was asking then. I thought he wanted to run run sudo to set ownership too the dummy user. –  Zoredache Mar 26 '12 at 20:06
    
This request seems a bit pointless as if chown is run on files as user dummy, only files that are owned by dummy could be changed maybe. Most of the modern kernels disallow chown by anybody but root to prevent things like quota evasion. –  mdpc Mar 26 '12 at 23:01

2 Answers 2

up vote 1 down vote accepted

The chown command requires root privileges. It will not run as any other user.

You could restrict your command to only being able to change the ownership of files to the dummy user however, as Zoredache noted, this will still allow them to edit any file on the system. I don't know if sudo will work if /etc/sudoers is not owned by root but I'm certain that giving an untrusted user permission to edit any file on the system would be sufficient to give them a full root shell.

You will want to restrict which files the user can change the ownership of as well.

Better still, find a better way of achieving what you are trying to achieve here.

What are you trying to achieve here?

share|improve this answer
    
You are right. I am attempting to make this work with chmod instead of chown. I have some files owned by "dummy" that should be inaccessible to anyone (including dummy, basically, since hes got no shell and no password and his account is expired). However if a user (group "users") needs to access such a file, they can run a script that lets somebody know and then makes a lockfile and does sudo -u dummy and changes file ownership -- make that permissions ...May be easier just to put these files in "users" group and setup a script that watches file access times or something. –  dogglebones Mar 26 '12 at 21:03
    
By the way I'd vote you up but my reputation precedes me. –  dogglebones Mar 26 '12 at 21:16

I'd suggest that you read almost all of man sudoers to gain a thorough understanding of what this does, but you want to do this:

%users ALL=(dummy) /bin/chown *
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.