I want to prevent users with sudoer access from using
sudo to execute
passwd (and thus changing the root password).
Is this possible? If so, how can it be accomplished?
You basically cannot forbid users from executing a particular command, if they're still allowed to execute all other commands – they could copy
If you want to stop sudoers from changing root's password – or somebody else's password – you cannot prevent that either; they can manually edit
(This could be achieved by e.g. using Kerberos or LDAP for authentication – that way nobody could change another user's password – but still nothing can prevent sudoers from simply breaking configuration or something like that.)
Basically, don't give full
It's very difficult to keep root user out of anything, but I believe you can do it with AppArmor.
The problem is, how would you set it up so that legitimate password changes can happen?
The trick might be to set up an AppArmor profile for
However, I suspect you could circumvent that by copying, moving or renaming the
Of course, you also have to protect AppArmor itself from modification. :)
The best solution is probably too give sudo access only for specific commands and then only for commands that don't change the filesystem.