Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If a user executes a command like

sudo /etc/init.d/apache2 restart

I would like to detect that and prevent that script from executing.

Can I do this without modifying the apache2 script?

share|improve this question

3 Answers 3

Most likely you want sudo chmod o-x /etc/init.d/apache2. This will prevent any user to run apache2 unless s/he is superuser, owner of the file or a member of it's group.

Check out chmod wiki for more information.

share|improve this answer

You should probably remove their sudo permissions. There is nothing you can do that they can't "undo" as long as they have them. If you can't trust them with the permissions, then they shouldn't have them in the first place.

share|improve this answer

You can limit what commands a user can execute, and even what privileges they can execute those commands as using sudo. All of these settings are done in the /etc/sudoers file, which is edited by the visudo command.

The very basic config that usually gets installed with sudo and used allows users in the wheel group to execute programs as the root user. The sudoers(5) man page gives extensive information on how to configure sudo so that a user can only execute a program that they should have access to, and what permissions they should be allowed to execute the program with.

Also note, even if a user has authorization to execute a command, sudo logs all usages. Usually this is to your syslog, whose location is dependent upon how you have logs and logging configured on your system.

If you are looking at mere experimentation (as opposed to truly wanting to stop someone from executing a program but still give them the keys to your kingdom through sudo), you could probably write a wrapper script for sudo. In the wrapper script, either intercept the log message to determine if the unwanted program was requested to run, or even better just look at the requested command to run under sudo privileges and either pass the command on to sudo normally or deny the action. Just be aware that a wrapper script could be bypassed as well if the user knows and can access the path to the sudo binary.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.