How can I provide sudo access for a user, but restrict them to only editing of files, and only files that are under a nominated directory. For example, I would like the user abc to be able to edit all files in /var/www/vhosts/hostabc/ and its children.


You can use sudoedit:

%editors_group ALL=(root) sudoedit /var/www/vhosts/hostabc/*

And add all editors to editors_group

Please note that the wildcard will allow this to work with paths such as /var/www/vhosts/hostabc/../../../../etc/sudoers.

| improve this answer | |
  • doesn't that give all the users in editors_group full root access though? – jsnfwlr Nov 29 '10 at 3:10
  • Nope. It only gives access to edit files as root. But you can strengthen the security by using a different user in sudo and as owner of the files. Please read the manual: linux.die.net/man/8/sudoedit – Mircea Vutcovici Nov 29 '10 at 3:34
  • 1
    Very helpful, +1. I wonder if you'd consider expanding your answer to include the following: 1) how to specify multiple files in the same line (or different lines), and 2) how to exclude a specified directory. – Seamus May 18 '19 at 1:06

It looks like there's no straightforward way. An old mailing list post implies that such a feature was discussed a few years ago, but a look at the current changelog shows that the post's pessimism is right, and nothing ever came of it.

Can you change the group ownership of those files? If you can, you can use chmod g+S /var/www/vhosts/hostabc, and then new files will also get that group. Alternately, and perhaps better although less transparent, you could use ACLs. These approaches would let you avoid using sudo at all.

| improve this answer | |

Or, to extend mattdm's suggestion, don't forget that sudo can be used to grant access to users other than root. You could create a custom user just for this purpose, chown -R customuser:customgroup /var/www/vhosts/hostabc, then give userabc sudo privileges to the customuser user. The user isn't used for anything else, so it's reasonably safe to do.

You also don't have to worry about using chmod +S to ensure inheritance, since the edits will be being done as the customuser user.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.