Say I have 2 users - 'alice' and 'bob' and want to allow 'alice' to run any command as root, but not run commands as 'bob' or any other user, am I able to do this, and if so how ?

consider this example that allows james to run any command as alice

james ALL=(alice) ALL

or this example that allows fred to run the ls command as root

fred ALL=(root) /bin/ls

I suspect it has something to do with modifications to /etc/sudoers, along the lines of

alice ALL=(root)  ALL ?
  • 5
    If you're giving alice the ability to run any command as root, you are giving her complete, total control over the computer. If you don't trust her with the ability to run commands as another user, you should not give her root. – cpast Mar 20 '13 at 20:21
  • 1
    What are you trying to do? or trying to prevent? If you give alice root, she can make any file (as root) read/write any file (as root) change the owners... the only thing they can't do is get root perms on NFS volumes (unless they configured them for this). You're not blocking anything. – Rich Homolka Mar 20 '13 at 21:26
  • It sounds like you either need better access control, or the use of sandbox-style program execution (e.g. Docker). There's no good reason to do this as stated... – Breakthrough Mar 20 '13 at 21:35
  • Simple example of how your proposed line fails: sudo su bob. Bam. Alice now has a shell as bob. Disallow su? cp /bin/sh ~/bobsh; sudo chown bob:users bobsh; sudo chmod 4055 bobsh. Bam. You now have a copy of the in your home directory that always runs as bob. Disallow those? Write a C program that calls setuid with bob's uid and then execs a shell. Compile it, run as root. You now are in a shell as bob. There are so many ways to do it that you pretty much need a whitelist-based system. – cpast Mar 20 '13 at 22:05

Once you're root, you can become any other user.

If you can limit alice to a restricted set of approved commands, you may be able to keep her from becoming another user, but then each command she runs as root needs to be checked to see if they have leaks that let her use a non-approved program. But this is very complex, and may not be feasible.

  • there has to be a easier way it is just in the /etc/sudoers – whatsup1234 Mar 20 '13 at 18:57
  • @whatsup1234 root can control anything, including becoming any other user. You just gave alice ALL perms, including a root shell, which lets her become any user. – Rich Homolka Mar 20 '13 at 20:02
  • 4
    There is no easier way. root can do anything on the system. Anything. For example, as root, alice could make a copy of bash, chown it to bob:users, and set the setuid bit on it. That would mean that any user running it runs it as bob. Alternatively (and more easily), alice could just run su bob and it will work. All sudoers lets you do is restrict alice to certain commands, but each of those commands runs with full root privileges, and so any issue in any of those commands lets alice authenticate as bob. – cpast Mar 20 '13 at 20:18

I believe Linux capabilities would let you launch a process without the ability to change user, even if root. setcap may do what you need, or you may want to look into SELinux. However, there needs to be more development work done in this area, it seems. Look at this Stack Overflow post.

  • from that post, it seems that setcap sets on a per executable basis. But, OQ set sudo rights to do anything, so you'd need to do the impossible - block all possible paths. – Rich Homolka Mar 20 '13 at 21:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.