1

My users are on Ubuntu running Docker and mounting directories in their sessions. The problem is that any non-existing directory or file mounted with Docker is owned by root.

I would like to allow my users to remove any root-owned file or directory under their $HOME directory with an /etc/sudoers directive. Something like :

# /!\ This is not working
%MyUsers ALL=NOPASSWD: /bin/rm $HOME/*
  • Is it possible within /etc/sudoers ?
  • What options do I have ?

Thanks for your help.

Using Docker-rootless mode is not an option for us.

1 Answer 1

2

If they're running docker as root, and they can control the daemon, they're already root.

Trying to grant them limited sudo permissions is pointless and you're better off granting them full root access to their machines.

In addition to which, it is nearly impossible without a wrapper to grant them permission to execute rm $HOME/* as root securely. I'd just have to ln -s / $HOME/root and I could delete anything.

1
  • 2
    Additionally, the users only need to run a container with a shell to remove the directory. Commented Jun 5, 2021 at 11:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .