Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a normal user on my system who needs to have write access on httpd.conf. If I have the following entry in my sudoers file:

joe ALL=(ALL) /usr/bin/vim /etc/httpd/confs/httpd.conf

Is there any risk in doing this?

share|improve this question
    
i wouldn't trust a 'normal' user. a syntax error could cause terrible troubles. if you want to grant him these privileges, he probably also needs to restart/reload the server. –  Rudolf Mühlbauer Oct 14 '12 at 18:52

2 Answers 2

up vote 1 down vote accepted

Best would be to change the group of that httpd.conf file (chgrp some-group .../httpd.conf), make the file group writable (chmod g+w .../httpd.cond). And make joe a member of that group.

But even then, I'm sure joe could use that to grant himself more rights as remember apache parses its configuration as root. It's only later on that it changes to www-data or whatever the HTTP user is on your system.

share|improve this answer

What happens if they open that file with sudo and then do :!/bin/bash ?

I seem to remember you can avoid this in vim (or sudo). But it's worth bearing in mind.

Here you go: VIM: "sudo vim bad_idea"?

Basically, you want rvim

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.