Sponsored Content
Top Forums UNIX for Dummies Questions & Answers Restrict a user from Executing particular command Post 302962174 by bakunin on Wednesday 9th of December 2015 11:06:00 AM
Old 12-09-2015
The others who answered you before already hinted at that, but to make it as explicit as paossible:

Security is not about first allowing everything and then disallowing something specific. It is the other way round: forbid everything, carefully identify what has to be allowed and then allow exeactly that (and not more).

If you have a house it is a bad idea to first tear down every wall and then put a locked door to block a tenth of the western side. It is better to have walls all around and then put a door exactly at where visitors need to come in.

Sudo rules like the one you described are flawed in such a way they are irredeemable. It would be a good idea to identify the users real needs (not "i don't want to be slowed down by these pesky 'you are not allowed to...'-messages", but real, legitimate and arguable needs) and put that into sudo-rules.

Perhaps, if the account has only the groups it needs to have, only the rights it needs to have and only the access it needs to have, then the problem of forbidding it some "rm"-command might be already gone because the account cannot delete a file or directory it doesn't have write-access to.

And, honestly: if a user is irresponsible enough to issue rm-commands where they are harmful - do you really trust him enough to allow him the other powers that come with a sudo-rule like the above? Off the top of my head i know 10 methods to delete the file effectively without using rm at all:

Code:
cat /foo/bar > targetfile
cp /foo/bar targetfile
> targetfile
mv /foo/bar targetfile
mv targetfile /dev/null
sed '1q' targetfile > targetfile
[...]

All these commands will either reduce the file targetfile to length 0, overwrite it with meaningless information from /foo/bar (replace that with the name of any file containing nothing usable) or otherwise destroy what is in the file. You might end up with a file but all the information it held is gone. I hardly can see any improvement over the "its-gone-completely-because-of-rm"-situation.

I hope this helps.

bakunin
 

10 More Discussions You Might Find Interesting

1. Solaris

restrict a user to certain command

Hi all, I am using Sun OS 5.10. I am new to Unix. Is there some way to restrict a specific user to certain command say "/usr/bin/more" ?? for example: I want that user1 can execute more command & user2 can't. Can we somehow edit .profile file in the home directory of user to achieve... (1 Reply)
Discussion started by: vikas027
1 Replies

2. Solaris

How to restrict the perticular command to user

Hi all, I want to restrict the perticular command to user. ex: CD, CP, mv etc ., "A" user cannot user CD, CP, mv commands from his home directory. so please let me know the procedure how to restrict the commands access to user "A". I really thankfull to all.... (3 Replies)
Discussion started by: murthy76
3 Replies

3. AIX

New user and restrict path

Hello I have a question in Aix 5.3 can I create a user, that only can see a specify path. I mean the user log in the default path its /home/newuser he type cd the path that need to check /example/directory_check but if he wants to go to / or any other path. we can not do this. I only... (1 Reply)
Discussion started by: lo-lp-kl
1 Replies

4. UNIX for Dummies Questions & Answers

Restrict command for an user ?

Hi everyone ! I got "viewer" and "root" user on a *nix computer. When i log in using "viewer" I only can use "df" command. When I try another command like "ls" it say : -bash: ls: command not found I checked permission of "/bin/ls" file, it has excute permission for everyone. Inside home... (4 Replies)
Discussion started by: camus
4 Replies

5. Red Hat

Restrict user to a particular directory

Hi I have a Fedora10 server and i need a particular user to view files only in a particular folder. All other files in other folders having "read" permission for all shouldn't be accessible to this user. Please let me know if ther's a way. Thanks, HG (5 Replies)
Discussion started by: Hari_Ganesh
5 Replies

6. UNIX for Dummies Questions & Answers

Restrict user access.

Hi All, How can we restrict a particular user access to a particular shell in solaris 10. Thanks in Advance. (5 Replies)
Discussion started by: rama krishna
5 Replies

7. Red Hat

Restrict user access

Hi there I have an application user on my system that wants accesses to these file systems as such: rwx: /SAPO /SAPS12 /R3_888 /R3_888B /R3_888F /R3_888R r: /usr/sap these are the existing FS permissions:ownerships: # ls -ld /SAPO (9 Replies)
Discussion started by: hedkandi
9 Replies

8. AIX

How to restrict user to a particular directory?

hi, I want to restrict some user access to only 1 directory (including all sub-directories/files in it). can you please explain me, how can we do this? example; Filesystem GB blocks Used Free %Used Mounted on /dev/hd4 2.61 1.02 1.59 40% / /dev/hd2 ... (7 Replies)
Discussion started by: aaron8667
7 Replies

9. Solaris

How to find IP of user machine executing a particular UNIX command?

Hello, Our applications are deployed in SunOS 5.10 servers. All the team members use a same username/pwd to login to the box. Very often we face issue were we could see that weblogic server instance are KILLED and we are not able to trace who executed kill command. All team members use PUTTY to... (2 Replies)
Discussion started by: santtarius
2 Replies

10. HP-UX

Restrict ssh for particular user

Dear Concern, We want to restrict ssh for particular user "oracle". Our HP UX version is as below. Please advise. # uname -a HP-UX tabsdb02 B.11.31 U ia64 2963363594 unlimited-user license (2 Replies)
Discussion started by: makauser
2 Replies
Graphics::Primitive::Component(3pm)			User Contributed Perl Documentation		       Graphics::Primitive::Component(3pm)

NAME
Graphics::Primitive::Component - Base graphical unit DESCRIPTION
A Component is an entity with a graphical representation. SYNOPSIS
my $c = Graphics::Primitive::Component->new({ origin => Geometry::Primitive::Point->new({ x => $x, y => $y }), width => 500, height => 350 }); LIFECYCLE
prepare Most components do the majority of their setup in the prepare. The goal of prepare is to establish it's minimum height and width so that it can be properly positioned by a layout manager. $driver->prepare($comp); layout This is not a method of Component, but a phase introduced by the use of Layout::Manager. If the component is a container then each of it's child components (even the containers) will be positioned according to the minimum height and width determined during prepare. Different layout manager implementations have different rules, so consult the documentation for each for details. After this phase has completed the origin, height and width should be set for all components. $lm->do_layout($comp); finalize This final phase provides and opportunity for the component to do any final changes to it's internals before being passed to a driver for drawing. An example might be a component that draws a fleuron at it's extremities. Since the final height and width isn't known until this phase, it was impossible for it to position these internal components until now. It may even defer creation of this components until now. It is not ok to defer all action to the finalize phase. If you do not establish a minimum hieght and width during prepare then the layout manager may not provide you with enough space to draw. $driver->finalize($comp); draw Handled by Graphics::Primitive::Driver. $driver->draw($comp); METHODS
Constructor new Creates a new Component. Instance Methods background_color Set this component's background color. border Set this component's border, which should be an instance of Border. callback Optional callback that is fired at the beginning of the "finalize" phase. This allows you to add some sort of custom code that can modify the component just before it is rendered. The only argument is the component itself. Note that changing the position or the dimensions of the component will not re-layout the scene. You may have weird results of you manipulate the component's dimensions here. class Set/Get this component's class, which is an abitrary string. Graphics::Primitive has no internal use for this attribute but provides it for outside use. color Set this component's foreground color. fire_callback Method to execute this component's "callback". get_tree Get a tree for this component. Since components are -- by definiton -- leaf nodes, this tree will only have the one member at it's root. has_callback Predicate that tells if this component has a "callback". height Set this component's height. inside_bounding_box Returns a Rectangle that defines the edges of the 'inside' box for this component. This box is relative to the origin of the component. inside_height Get the height available in this container after taking away space for padding, margin and borders. inside_width Get the width available in this container after taking away space for padding, margin and borders. margins Set this component's margins, which should be an instance of Insets. Margins are the space outside the component's bounding box, as in CSS. The margins should be outside the border. maximum_height Set/Get this component's maximum height. Used to inform a layout manager. maximum_width Set/Get this component's maximum width. Used to inform a layout manager. minimum_height Set/Get this component's minimum height. Used to inform a layout manager. minimum_inside_height Get the minimum height available in this container after taking away space for padding, margin and borders. minimum_inside_width Get the minimum width available in this container after taking away space for padding, margin and borders. minimum_width Set/Get this component's minimum width. Used to inform a layout manager. name Set this component's name. This is not required, but may inform consumers of a component. Pay attention to that library's documentation. origin Set/Get the origin point for this component. outside_height Get the height consumed by padding, margin and borders. outside_width Get the width consumed by padding, margin and borders. finalize Method provided to give component one last opportunity to put it's contents into the provided space. Called after prepare. padding Set this component's padding, which should be an instance of Insets. Padding is the space inside the component's bounding box, as in CSS. This padding should be between the border and the component's content. page If true then this component represents stand-alone page. This informs the driver that this component (and any children) are to be renderered on a single surface. This only really makes sense in formats that have pages such as PDF of PostScript. prepare Method to prepare this component for drawing. This is an empty sub and is meant to be overridden by a specific implementation. preferred_height Set/Get this component's preferred height. Used to inform a layout manager. preferred_width Set/Get this component's preferred width. Used to inform a layout manager. to_string Get a string representation of this component in the form of: $name $x,$y ($widthx$height) visible Set/Get this component's visible flag. width Set/Get this component's width. AUTHOR
Cory Watson, "<gphat@cpan.org>" BUGS
Please report any bugs or feature requests to "bug-geometry-primitive at rt.cpan.org", or through the web interface at http://rt.cpan.org/NoAuth/ReportBug.html?Queue=Geometry-Primitive <http://rt.cpan.org/NoAuth/ReportBug.html?Queue=Geometry-Primitive>. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes. COPYRIGHT &; LICENSE Copyright 2008-2009 by Cory G Watson. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself. perl v5.12.3 2011-06-02 Graphics::Primitive::Component(3pm)
All times are GMT -4. The time now is 10:56 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy