Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a normal user on my system who needs to have write access on httpd.conf. If I have the following entry in my sudoers file:

joe ALL=(ALL) /usr/bin/vim /etc/httpd/confs/httpd.conf

Is there any risk in doing this?

share|improve this question
i wouldn't trust a 'normal' user. a syntax error could cause terrible troubles. if you want to grant him these privileges, he probably also needs to restart/reload the server. – Rudolf Mühlbauer Oct 14 '12 at 18:52
up vote 2 down vote accepted

Best would be to change the group of that httpd.conf file (chgrp some-group .../httpd.conf), make the file group writable (chmod g+w .../httpd.cond). And make joe a member of that group.

But even then, I'm sure joe could use that to grant himself more rights as remember apache parses its configuration as root. It's only later on that it changes to www-data or whatever the HTTP user is on your system.

share|improve this answer

What happens if they open that file with sudo and then do :!/bin/bash ?

I seem to remember you can avoid this in vim (or sudo). But it's worth bearing in mind.

Here you go: VIM: "sudo vim bad_idea"?

Basically, you want rvim

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .