0

I would like to grant sudo privileges to a user but only on a specific path. For example:

user@domain $> sudo touch /etc/test/directory/samplefile

where that user doesn't have permissions to the /etc/test/directory path which doesn't belong to the user, and I don't want to open the permissions more, I don't want to make the user part of the directory's group because that would give the user permissions to other directories as well.

So far I've tried to add this in the /etc/sudoers file:

user ALL:/etc/test/directory/=(ALL) NOPASSWD: ALL

but that syntax is not right according to visudo.

any ideas on how to do this approach?

  • 3
    I don't think sudo is capable of this. You are likely going to need to think of a different approach for whatever you are trying to do. – Michael Hampton Jun 21 at 17:10
  • "I don't want to make the user part of the directory's group because that would give the user permissions to other directories as well. " Create a new group specifically for this problem, change only this directory to be owned by this new group and add your user in the group. That can solve your problem without having to use sudo which is nice and powerful and hence can create problems just by itself. But otherwise I agree with Michael that you are not describing your core problem sufficiently as exposed as it is it is not a good fit for sudo. – Patrick Mevzek Jun 21 at 17:58
  • @MichaelHampton what I'm trying to do is to create a script which is generating a file in a directory that is owned by a specific user, the script that is executing this, can't save the file there because it doesn't have the permissions to do that, I don't want to open the permissions more because it would be insecure, also the generated file has to have the permissions of onwership and group the same as the directory, so I don't see any other option. – VaTo Jun 21 at 19:23
  • @PatrickMevzek If you are interested as well, that above is what I'm trying to do. Thank you both for your responses. – VaTo Jun 21 at 19:24
  • 2
    Consider file system acl’s which can offer much more granular access rights than what can be achieved with only the conventional user-group-other model. – HBruijn Jun 21 at 22:20
1

You can probably do this by using sudo to allow users (one/some/all) to run the script as a user that is a member of the group, etc. that has access rights to the directory.

This page - https://lifecs.likai.org/2016/02/generic-setuidsetgid-wrapper-for-scripts.html seems to tackle your problem quite well, the sudoers line suggested -

ALL ALL = (script-owner) NOPASSWD: /path/to/script

run with sudo -u script-owner /path/to/script

  • I think there's a confusion, I want to be able to run "sudo" in a specific location no a script located in a specific location. – VaTo Jun 23 at 2:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.