1

If I have a folder at /var/secret/ and give a user access to the sudo command, is there a way to allow them to have full access to everywhere else, BUT /var/secret/ and give them absolutely no access to it?

3
  • sudo is highly configurable, and exists so you don't need to give full root access to users. What exactly do they need to be able to do?
    – Paul
    Sep 7, 2015 at 2:18
  • I'm fully aware of that, but I explained what I wanted in the question and that's what I want to know an answer for, if one exists.
    – markzz
    Sep 7, 2015 at 2:20
  • You explain you wanted to give them the sudo command. But to do what? If it is give them full root access, then the answer is you can't, because root is root. But if you want to give them the sudo command to do a subset of things, then the answer "maybe, it depends". Hence the clarification request.
    – Paul
    Sep 7, 2015 at 2:23

1 Answer 1

1

This is almost (but not theoreticially) impossible. Once the user has sudo access which is not highly limited, they have root access - for example, running sudo /bin/bash will create a bash shell with root privileges and would be able to bipass any mechanisms put in place by root.

The theoretical way to do it would be to craft sudo rules that allow the user to do pretty much anything that they want/need, excepting the ability to execute all the commands that could access this resource - almost certainly not possible to do in practice.

You may also be able to use SELinux or Apparmour to limit the ability to access directories - but again, someone with root can undo this.

You may be able to frustrate access to the specified resource by keeping it encrypted and mounting the encrypted volume - I expect this will not prevent access, but it will prevent casual access. [ I notice that when I use FUSE to remotely mount a filesystem as a user, only the user who mounted the filesystem can access it. Ofcourse, as I'm root I can simply SU back to that user and see the files - and no doubt there are other ways to do this ] Also, if the resource is not mounted when the user has root access, and the key is not stored in memory, they can't get it either.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .