I need to prevent sudo user from start/restart or stop multiple services.
I'v edited /etc/sudoers:
Cmnd_Alias LIMITED_CMDS=/bin/su,/bin/systemctl stop nginx,/bin/systemctl start nginx,/bin/systemctl restart nginx mytestuser ALL=!LIMITED_CMDS
But he can do like:
ln -s /bin/su /tmp/su2 and than use
sudo su2 to become a root and execute all.
And also sudo user can execute
sudo service stop nginx or
/etc/init.d/nginx stop. I of course can list them in Cmnd_Alias too, but what if I need to limit control to multiple services? Too large construction and anyway simlink from /bin/su will do the trick. May be I missed something, but is Linux has a good tool/config to limit user's rights to control some services?
I'v googled and found only variants with sudoers file, but this is not what I need
The simple way - do not add sudo rights to user :) but in my case user must be in sudo group.