How to grant user modify only specific protected file by sudo

Question

I need to grant user modify some files by sudo that have only read-only access.

For example, I want to grant user 'hosteditor' modify '/etc/hosts' file. I added to sudoers follow line:

hosteditor ALL=(root) /usr/bin/vim /etc/hosts

Now, user hosteditor can use vim only for modifying /etc/hosts file. But if these user while modifying file enter !/bin/sh he will get grant to execute all commands with root permission.

What I should to do to grant user modify only specific file without possibility hack system.

Answer 1

After some studying this problem I have found 3rd variant of solving this problem.

By editing sudoers we can give user permission to run sudoedit. It's secure way to modify root-only files, without possibility of hack. So answer is

hosteditor ALL=(root) sudoedit /etc/hosts

Answer 2

Don't use SUDO for this. Instead, add hosteditor into a group, and delegate write access to that group, using POSIX File ACLs. Look up http://linux.die.net/man/1/setfacl for a command for managing the Access Control Lists, and http://linux.die.net/man/5/acl for the actual write-up on ACLs under Linux. This assumes, of course, that you are using a filesystem and authentication system that support POSIX File Access Control Lists. To ensure that the permissions remain applied, you would likely want to delegate the application of the ACL to a configuration management tool. Puppet can do POSIX ACLs (see https://github.com/dobbymoodge/puppet-acl). CFEngine can do this (see https://auth.cfengine.com/archive/manuals/cf-manuals/cf2-Reference#acl), and I am sure Chef can, as well.

The other option is to provide a command or service that the hosteditor can use to generate the /etc/hosts file from a database/spreadsheet and a template. This would increase flexibility and enable you to put controls into the command or service.

I am sure there are other good ways to solve this as well, including a separate DNS instance (or even a separate DNS view, if using BIND9), and giving the hosteditor account the ability to add and remove records using the NSUPDATE command (see http://linux.die.net/man/8/nsupdate)

Good luck.

Answer 3

Any command can be run from vi including a shell so allowing a user to run vi through sudo isn't secure. A safer option would be to set permissions as the previous answer suggests. If you can't do that, configure sudo to allow copying to the file:

Cmnd_Alias CP_ETC_HOSTS = /bin/cp -v ./hosts /etc/hosts

They can edit a copy of the file and copy their modified version to /etc/hosts.