Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Deny to edit a specific file in sudoers
Top Forums UNIX for Dummies Questions & Answers Deny to edit a specific file in sudoers Post 302763439 by bakunin on Wednesday 30th of January 2013 04:02:33 AM
Old 01-30-2013
You shouldn't allow to edit any file at all via sudo. This is what group ownerships are meant for: instead of doing it via sudo you make the file owned by a certain group, grant the group the write-privilege and make any user allowed to edit the file a member of this group.

Code:
# ls -l /file/in/question
-rw-rw---- 1 root mayedit 11872 2013-01-29 18:34 /file/in/question

# groups willedit
willedit : users mayedit

# groups willnotedit
willnotedit : users

Now you add any user who should be able to edit the file to the "willedit" group and all others are left out.

The reason why you shouldn't do that via sudo is because most editors allow shell escapes and this is one of the classical ways to circumvent restrictions via sudo: to allow sudo vi /some/file for instance means that the user is allowed to set up the process vi /some/file as root. Issuing ":!sh" in this vi session now escapes to a normal shell in which the user is now fully root. You don't need any sudo restrictions in place in this case any more.

I hope this helps.

bakunin
 

10 More Discussions You Might Find Interesting

1. Linux

sudoers file

Hi, I have edited 'sudoers' file to allow 'cads' user shutdown the system without providing a password. Can someone tell me what's wrong with my file? It's not working when I 'sudo SHUTDOWN' command: sudo: SHUTDOWN: command not found Thanks a lot! # Host alias specification... (4 Replies)
Discussion started by: whatisthis
4 Replies

2. UNIX for Advanced & Expert Users

deny deletion of a file without omiting w permission

how to forbid deleting a file even though the file is owned by the user? I thought of setfacl command on solaris. Any hints please? thx (2 Replies)
Discussion started by: melanie_pfefer
2 Replies

3. UNIX for Dummies Questions & Answers

sudoers file questions

What is the difference between ALL and localhost in the bellow? # %users ALL=/sbin/mount /cdrom,/sbin/umount /cdrom # %users localhost=/sbin/shutdown -h now Thank you. (2 Replies)
Discussion started by: hemangjani
2 Replies

4. AIX

Does ACL can only grant/deny access for specific command?

Dear AIX/UNIX experts: I have a demand to restricted a file to be copy by others, but this file must can be read by others/Applications. As I tried, the chmod command cannot fulfill this requirement. But not sure if the ACL can achieve this function or not ? Could anybody give me your... (8 Replies)
Discussion started by: devyfong
8 Replies

5. UNIX for Advanced & Expert Users

sudoers file

i have defined a rule in the sudoers file so a specific user is able to run some commands as sudo with no password. my question is: is it possible to restrict a user to run commands as sudo only in a certain directory? for example: chown only the files that are located in /var/tmp. Thank you. ... (2 Replies)
Discussion started by: noam128
2 Replies

6. Shell Programming and Scripting

How to edit specific variable in file?

HI guys i have a question. Question 1: how do i modify a particular string? e.g echo "Please enter Book Title: " read a echo "Please enter Author: " read b if ] then echo " Record found!" which will then pop out a menu with the follow output 1. Update Name 2.... (1 Reply)
Discussion started by: ichar
1 Replies

7. Shell Programming and Scripting

Edit file content at the specific line.

How to edit file content at the specific line? For example at below The things to edit --> This is line 2. And it is below line 1. This is line 1. This is line 2. # i want to append some words at this row line. How? This is line 3. (8 Replies)
Discussion started by: alvin0618
8 Replies

8. HP-UX

Unable to edit the sudoers file using script

Hi All, I've made a script in order to delete the users. The script is deleting the users and removing its entry from the /etc/sudoers however it is changing the permissions of the /etc/sudoers file to the user from which it is executing the script. #!/bin/ksh #set -x print "The script... (2 Replies)
Discussion started by: Kits
2 Replies

9. UNIX for Dummies Questions & Answers

Help with Sudoers file

Hi using Solaris 10. trying to update /etc/sudoers file I need to add all the fist level operation team. This is what I have but it doesn't seem to work. Please help.Error message sudo su - >>> sudoers file: parse error, line 9 <<< >>> sudoers file: parse error, line 9 <<< ... (2 Replies)
Discussion started by: samnyc
2 Replies

10. Solaris

Sudoers file

In the sudoers file in Solaris... I am trying to limit the DEVELOPER user privileges to where those users can only use the “rm” command in certain directories. This is to prevent them from deleting directories or files and destroying a server. I want them to be able to use the "rm" command but... (1 Reply)
Discussion started by: nzonefx
1 Replies

LEARN ABOUT ULTRIX

dwtcstextgeteditable

DwtCSTextGetEditable(3Dwt)												DwtCSTextGetEditable(3Dwt)

Name
       DwtCSTextGetEditable  - Obtains the current edit permission state indicating whether the user can edit the text in the compound-string text
       widget.

Syntax
       Boolean DwtCSTextGetEditable(widget)
	    Widget widget;

Arguments
       widget	 Specifies the ID of the compound-string text widget.

Description
       The DwtCSTextGetEditable function returns the current edit-permission-state, which indicates whether the user can edit the text in the com-
       pound-string  text  widget.   If  the  function	returns True, the user can edit the string text in the compound-string text widget.  If it
       returns False, the user cannot edit the text.

Return Values
       Specifies a boolean value that, when True, indicates the user can edit the text in the compound string text widget.  When False,  the  user
       cannot edit the text.

See Also
       DwtCSText(3Dwt),  DwtCSTextCreate(3Dwt), DwtCSTextReplace(3Dwt), DwtCSTextSetString(3Dwt), DwtCSTextSetEditable(3Dwt), DwtCSTextGet-
       MaxLength(3Dwt), DwtCSTextSetMaxLength(3Dwt), DwtCSTextSetSelection(3Dwt), DwtCSTextGetSelection(3Dwt)
       Guide to the XUI Toolkit: C Language Binding
       Guide to the XUI Toolkit Intrinsics: C Language Binding

															DwtCSTextGetEditable(3Dwt)
All times are GMT -4. The time now is 04:50 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy