The way I usually implement this kind of restrictions requires that several conditions are met, otherwise the restrictions can be easily circumvented:
- The user does not belong to the
wheel group, the only one authorized to use
su (enforced via PAM).
The user is given a properly secured
rbash with a read-only
PATH pointing to a private
~/bin/ directory contains links to simple utilities:
$ ll ~/bin
lrwxrwxrwx. 1 root dawud 14 Sep 17 08:58 clear -> /usr/bin/clear*
lrwxrwxrwx. 1 root dawud 7 Sep 17 08:58 df -> /bin/df*
lrwxrwxrwx. 1 root dawud 10 Sep 17 08:58 egrep -> /bin/egrep*
lrwxrwxrwx. 1 root dawud 8 Sep 17 08:58 env -> /bin/env*
lrwxrwxrwx. 1 root dawud 10 Sep 17 08:58 fgrep -> /bin/fgrep*
lrwxrwxrwx. 1 root dawud 9 Sep 17 08:58 grep -> /bin/grep*
lrwxrwxrwx. 1 root dawud 10 Sep 17 08:58 rview -> /bin/rview*
lrwxrwxrwx. 1 root dawud 13 Sep 17 08:58 rvim -> /usr/bin/rvim*
lrwxrwxrwx. 1 root dawud 13 Sep 17 08:58 sudo -> /usr/bin/sudo*
lrwxrwxrwx. 1 root dawud 17 Sep 17 08:58 sudoedit -> /usr/bin/sudoedit*
lrwxrwxrwx. 1 root dawud 13 Sep 17 08:58 tail -> /usr/bin/tail*
lrwxrwxrwx. 1 root dawud 11 Sep 17 08:58 wc -> /usr/bin/wc*
the user is given a restricted, read-only environment (think of stuff like
- optionally, the user is mapped to the SELinux user
staff_u and given rights to execute commands as other user as required via
/tmp and possibly
/var/tmp are polyinstantiated via
/tmp /tmp/.inst/tmp.inst-$USER- tmpdir:create root
/var/tmp /tmp/.inst/var-tmp.inst-$USER- tmpdir:create root
$HOME $HOME/$USER.inst/ tmpdir:create root
/etc/security/namespace.init makes all skeletal files readonly for the user and owned by
This way you can choose whether
$USER can execute any command on his/her own behalf (via a link in the private
~/bin directory, provisioned via
/etc/skel, as explained above), on behalf of other user (via
sudo) or none at all.
With regards to "access to a set of files", you don't specify whether it's read-only or read-write access.
In any case, this can be set up through
I would implement rules to grant read-only access to files via
rview and read-write via
rvim, the latter normally being configured using the
editor directive in your
So users can
sudoedit allowed files.
This solution can be fairly easily implemented using your configuration management tool of choice.
New commands can be added to the private
~/bin directory very quickly (since they are just symlinks managed from the namespacing logic).
sudo rules can also be managed the same way.