Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up the sudoers file to allow users to chown files only under a certain directory

for example

%hmis    ALL=/bin/chown eng:hmis /usr/lib/bogimac/bsc/*

is not good because hackers can do the following:

sudo chown eng:hmis /usr/lib/bogimac/bsc/ /etc/important_file

Does anyone know how to prevent this?


share|improve this question

migrated from Apr 25 '12 at 15:02

This question came from our site for professional and enthusiast programmers.

Even if you solve your immediate problem, someone could still type...

sudo chown eng:hmis /usr/lib/bogimac/bsc/../../../etc/shadow

Or any other permutation of the above. sudo isn't really the right tool for this sort of restriction. If you really need to delegate the ability to change ownership in a specific hierarchy like this, then your best bet is probably to write a simple wrapper script in your favorite high-level scripting language that iterates over its path arguments, sanitizes them, and checks them against a list of allowed prefixes.

share|improve this answer

Thanks for your answer, I hadn't thought of that. Since I only need to use the chown command for this particular command:

chown eng:hmis /usr/lib/bogimac/bsc/*

I decided to make a shell script to be run only by root and then allow that command to be run in sudo, see Limit sudo to only one directory and it's subdirectories by sudoers file

share|improve this answer

We've implemented the following which seems to work

Cmnd_Alias EDIT =  /bin/rvi /usr/lib/bogimac/bsc/*, \
                  !/bin/rvi /usr/lib/bogimac/bsc/* *, \
                  !/bin/rvi /usr/lib/bogimac/bsc/*..*
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.