Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to allow to delete certain files in /tmp directory to sudo users. I have added the Allow_Cmnd /usr/sbin/userdel for sudo users but this does not delete all /tmp files associated with the user.

So how shall I tweak the sudoers to allow them to delete certain files in /tmp directory only. I googled a bit but learned that regex may be be application at this. I tried couple of tweaks but its not working for me.

I would like the users to have ability to execute command such as

find /tmp -uid 10002 | grep joeuser | xargs rm -rf 
share|improve this question
    
Why the grep joeuser? –  DerfK Oct 24 '12 at 16:03
add comment

2 Answers 2

up vote 2 down vote accepted

The best thing to do is write a script that does what you want. You can do extensive sanity checking in there, check if the user is doing only what they are allowed, and so on. And then only allow that script to be ran from sudo.

Alternatively you can also allow them to run the command as you described it: /bin/bash -c "find /tmp -uid 10002 | grep joeuser | xargs rm -rf", or even simpler find /tmp -uid 10002 -path \*joeuser\* -delete.

As pointed out already, using xargs this way is not a good idea. You can either use find -print0 | xargs -0, or my personal recommendation is: find /tmp -uid 10002 -path \*joeuser\* -depth -exec rm -rf {} +. If your version of find does not support the +, you may use \; instead.

share|improve this answer
1  
first option with xargs is dangerous because it can easily be tricked to delete anything. It does not handle files and dirs with spaces properly due to IFS being space so you should use find -print0 and xargs -0 –  Hrvoje Špoljar Oct 24 '12 at 16:53
    
but without xargs or -exec , how to delete the directories. the -delete only removes files. –  chandank Oct 25 '12 at 18:54
    
@chandank: This is not true. find -delete deletes everything that matches. It also implies -depth, so it will delete the innermost paths before deleting a parent directory. –  chutz Oct 26 '12 at 0:25
1  
I may be doing something wrong. But find . -name myname -delete find: cannot delete ./myname': Directory not empty`. –  chandank Oct 26 '12 at 0:37
1  
@chandank: I see what you mean. -delete does delete directories, but does not delete directories recursively. –  chutz Oct 26 '12 at 2:27
show 2 more comments

I believe a well-written script will be your best option. However, this really depends on the overall goal and how well the design is planned... Do you want the files in /tmp to be deleted that belong to the user executing the script or should the script accept parameters for UID and username?

There are obvious security concerns and you need to be very careful. During your testing, I would not institute the actual delete, but log (output) the files that "would" be deleted if the delete code was in place. I would then test about 3 more times to be certain.

Lastly, the other option depending on your needs would be to write a more generic script and schedule it to run at a certain date/time via cron to automate the process.

BTW:

/usr/sbin/userdel is NOT the command you want. That is for deleting local user accounts.

-Brendan

share|improve this answer
    
@Brendan, Thanks for pointing out. Yes I want a user to delete the /tmp file entries of other users using UID and user name. In my setup I want a non priviledged user should have just enough power to delete the other users and their /tmp files only. As of now using sudoer file and sudo command they are able to user account but not able to delete the /tmp file. –  chandank Oct 24 '12 at 20:40
    
Is it the /tmp dir on the main filesystem or something like /home/user/tmp? The command for removing files is 'rm'. That would need to be added to the line in the sudoers file to grant access to that application. –  bmurtagh Oct 24 '12 at 20:42
    
this is filesystem's /tmp directory where all gconf and other GUI related temp files are stored. –  chandank Oct 24 '12 at 20:50
    
You'll need to grant the sudo user access to rm and develop the script to handle the deletion and test, test, test, and test again before it goes into production. Follow the advice I posted previously and comment out the 'rm' commands and output what files would be deleted so you can make sure the script is grabbing the correct files. –  bmurtagh Oct 24 '12 at 21:07
    
Thanks, I will try that out. –  chandank Oct 24 '12 at 21:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.