8

Is it possible to edit the sudoers file so a user can use sudo for any command except for a specified one? I reverse is true, I believe, that the sudoers file can be setup so that a user can only execute a given list of commands.

EDIT: the commands I really want to take away are halt and reboot... this makes me think there are special system calls for halt and reboot. Can you take system calls away from a user? If not, is it because the unix permission system abstracts over system calls neglecting this?

Improve this question

9 Answers 9

Reset to default
5

Another way to look at it is that if the users have largely unrestricted root access they can easily gain full root access.

While you might be able to work something out it would be easily circumvented.

SElinux though is a possible way, although it does take a lot to learn.

Improve this answer
4

Yes and no... You can prevent a user from running a specific file by preceding the file with a bang (!), however you cannot stop a user from copying the file to another location and then running it from there.

User_Alias    ADMINS = peter, bob, bunny, %operator

ADMINS        ALL    = !/usr/bin/su, !SHELLS

Granting Access to Specific Files as Another User

Improve this answer
2
  • Example of the how to set the "SHELLS" above: Cmnd_Alias SHELLS= /bin/sh, /bin/ksh, /bin/bash, /bin/zsh, \ /bin/csh, /bin/tcsh, \ /usr/bin/login, /usr/bin/su
    – pulcher
    Jul 7, 2009 at 2:43
  • A bunch of utilities will let you run commands as root (tar, links, and nmap off the top of my head), so I honestly think the real solution is to either a) whitelist commands you want run as root or b) just hire someone you trust
    – Some Linux Nerd
    Apr 1, 2015 at 0:21
3

To do what you want (keep the user form running halt, reboot and shutdown), you're going to have to look into SElinux stuff to prevent the user from making those syscalls. Otherwise the user will just run /bin/sh first and then run /bin/halt without going through sudo.

Improve this answer
1
  • 2
    Or any one of a zillion programs you can get a shell from, or their own scrip.
    – Ronald Pottol
    Jul 7, 2009 at 3:36
3

Log everything they do via sudo, presumably, you have some way to get the point across to not do it again.

Defaults logfile=/var/log/sudolog

will log all commands they run, google a bit for more info.

Improve this answer
1
  • You will need centralized logging and you will need to shout at them if they run a shell. A shell can be gained from an editor for example. or man man etc.
    – James
    Jul 7, 2009 at 8:01
2

If the user really wants to reboot, he will find a way. sudo -s, sudo -i, sudo $EDITOR /etc/sudoers... can be used to remove your restrictions.

And on Unix-like systems you are allowed to reboot the system as long as you're root (uid 0). If you do find a way to restrict those system calls, one could do this:

user$ echo b | sudo tee /proc/sysrq-trigger

or a variation thereof. Or reboot by causing a kernel panic. Or...

Finally, having root access usually gives you the ability to remove whatever restrictions are in place.

Improve this answer
2
  • It sucks that Linux no longer has securelevels. They weren't perfect, but man were they easy to set up. They didn't prevent reboot, but prevented a lot of other stuff. And since they were so easy you could use them on all systems. No tweaking and such needed.
    – Thomas
    Jul 7, 2009 at 8:41
  • Weren't they in BSD, not Linux?
    – u1686_grawity
    Jul 7, 2009 at 9:24
1

sure, as root call visudo and prevent 'user' from running /sbin/halt:

user ALL=(ALL) NOPASSWD: !/sbin/halt
Improve this answer
1
  • I believe that the request was for a list of commands that the user is NOT allowed to run
    – Wayne
    Jul 7, 2009 at 2:39
1

There is a risk in doing this way: there are often may ways to do the same action. For example, telnit 6 or init 6 does a reboot too. There might be a way to force the kernel to core dump and reboot too.

Improve this answer
1

The following line should let the user "jim" run everything but /usr/bin/kill and /usr/bin/su.

jim          ALL= !/usr/bin/kill,!/usr/bin/su
Improve this answer
0

This is untested and YMMV but what about setting up a cmd_list of the commands you dont want run and then use !cmd_list for the specified group/user?

I dont have access to test this and just looked at the manual page online at Sudoers Manual so some experts will correct me here if I am wrong

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .