2

I need to grant user modify some files by sudo that have only read-only access.

For example, I want to grant user 'hosteditor' modify '/etc/hosts' file. I added to sudoers follow line:

hosteditor ALL=(root) /usr/bin/vim /etc/hosts

Now, user hosteditor can use vim only for modifying /etc/hosts file. But if these user while modifying file enter !/bin/sh he will get grant to execute all commands with root permission.

What I should to do to grant user modify only specific file without possibility hack system.

  • /etc/hosts does not normally have execute perms so putting a shebang at the start won't normally have any effect. – user619714 Nov 2 '14 at 19:36
  • FYI "sudo sudoedit" is the general way of solving this problem. – Andy Nov 2 '14 at 23:44
4

After some studying this problem I have found 3rd variant of solving this problem.

By editing sudoers we can give user permission to run sudoedit. It's secure way to modify root-only files, without possibility of hack. So answer is

hosteditor ALL=(root) sudoedit /etc/hosts
2

Don't use SUDO for this. Instead, add hosteditor into a group, and delegate write access to that group, using POSIX File ACLs. Look up http://linux.die.net/man/1/setfacl for a command for managing the Access Control Lists, and http://linux.die.net/man/5/acl for the actual write-up on ACLs under Linux. This assumes, of course, that you are using a filesystem and authentication system that support POSIX File Access Control Lists. To ensure that the permissions remain applied, you would likely want to delegate the application of the ACL to a configuration management tool. Puppet can do POSIX ACLs (see https://github.com/dobbymoodge/puppet-acl). CFEngine can do this (see https://auth.cfengine.com/archive/manuals/cf-manuals/cf2-Reference#acl), and I am sure Chef can, as well.

The other option is to provide a command or service that the hosteditor can use to generate the /etc/hosts file from a database/spreadsheet and a template. This would increase flexibility and enable you to put controls into the command or service.

I am sure there are other good ways to solve this as well, including a separate DNS instance (or even a separate DNS view, if using BIND9), and giving the hosteditor account the ability to add and remove records using the NSUPDATE command (see http://linux.die.net/man/8/nsupdate)

Good luck.

1

Any command can be run from vi including a shell so allowing a user to run vi through sudo isn't secure. A safer option would be to set permissions as the previous answer suggests. If you can't do that, configure sudo to allow copying to the file:

Cmnd_Alias CP_ETC_HOSTS = /bin/cp -v ./hosts /etc/hosts

They can edit a copy of the file and copy their modified version to /etc/hosts.

  • Thank you for another one variant of solving my task, but DTK's answer more suited to my problem. – Vladislav Koroteev Nov 3 '14 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.