4

How can I provide sudo access for a user, but restrict them to only editing of files, and only files that are under a nominated directory. For example, I would like the user abc to be able to edit all files in /var/www/vhosts/hostabc/ and its children.

0

3 Answers 3

6

Solution 1: You can use sudoedit:

%editors_group ALL=(root) sudoedit /var/www/vhosts/hostabc/*

And add all editors to editors_group

The wildcard will not allow path traversal because

Wildcards used in sudoedit command line arguments are expected to be path names, so a forward slash (‘/’) will not be matched by a wildcard

Also note:

Users should never be granted sudoedit permission to edit a file that resides in a directory the user has write access to, either directly or via a wildcard. If the user has write access to the directory it is possible to replace the legitimate file with a link to another file, allowing the editing of arbitrary files. Starting with version 1.8.15, sudoedit will refuse to open a symbolic link unless either the sudoedit_follow Defaults option is enabled or the sudoedit command is prefixed with the FOLLOW tag. However, it is still possible to create a hard link if the directory is writable and the link target resides on the same file system.

Source: sudoers man page.

Solution 2: Instead of using sudo mechanism, you could use POSIX ACLs.

groupadd hostabc  # Create a group that will have read-write access to the folder
setfacl -R -m g:hostabc:rwX /var/www/vhosts/hostabc/ # Allow full access for hostabc group, recursively
setfacl -R -d -m g:hostabc:rwX /var/www/vhosts/hostabc/ # Same permissions for new files and folders
getfacl /var/www/vhosts/hostabc/  # To show the permissions
usermod -a -G hostabc user1  # Add user1 to hostabc group
7
  • doesn't that give all the users in editors_group full root access though?
    – jsnfwlr
    Nov 29, 2010 at 3:10
  • Nope. It only gives access to edit files as root. But you can strengthen the security by using a different user in sudo and as owner of the files. Please read the manual: linux.die.net/man/8/sudoedit Nov 29, 2010 at 3:34
  • 1
    Very helpful, +1. I wonder if you'd consider expanding your answer to include the following: 1) how to specify multiple files in the same line (or different lines), and 2) how to exclude a specified directory.
    – Seamus
    May 18, 2019 at 1:06
  • You mean the solution you proposed does NOT allow editing /var/www/vhosts/hostabc/../../../../etc/sudoers right?
    – HCSF
    Feb 24, 2021 at 7:04
  • The sudo man page is not documenting this. There is a bug related to wildcards: cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5602 But this should be fixed. I reverted the edit, but you should test the directory traversal escalation. Report it as a bug to sudo. Feb 26, 2021 at 18:53
2

It looks like there's no straightforward way. An old mailing list post implies that such a feature was discussed a few years ago, but a look at the current changelog shows that the post's pessimism is right, and nothing ever came of it.

Can you change the group ownership of those files? If you can, you can use chmod g+S /var/www/vhosts/hostabc, and then new files will also get that group. Alternately, and perhaps better although less transparent, you could use ACLs. These approaches would let you avoid using sudo at all.

1

Or, to extend mattdm's suggestion, don't forget that sudo can be used to grant access to users other than root. You could create a custom user just for this purpose, chown -R customuser:customgroup /var/www/vhosts/hostabc, then give userabc sudo privileges to the customuser user. The user isn't used for anything else, so it's reasonably safe to do.

You also don't have to worry about using chmod +S to ensure inheritance, since the edits will be being done as the customuser user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .