0

I have scientific linux 6.4 running on my system, I have restricted other users to run shell script except one, which is defined in /etc/sudoers file.

For example:

I have one file.sh in my admin's home directory, so I wish admin to run file.sh only, not other shell script from anywhere in system location.

So how to achieve this?

2
  • So youre saying you want admin to be incapable of executing any script but the one? Or is that vice versa? If the former you can just set it as admin's login shell with chsh maybe or in /etc/passwd and exec it in a chroot or something. If the latter you probably want to chmod the file. – mikeserv Jun 30 '14 at 8:54
  • I mean to say, files which is defined in /etc/sudoer file only should be run by admin not others. @mikeserv – Rahul Jun 30 '14 at 8:59
1

From: http://www.sudo.ws/sudoers.man.html

username ALL=(ALL:ALL) /some/random/command

should allow username to run /some/random/command as any other user (including root) from any host. No one but username would be able to run that command if that is the only rule in the file.

Make sure there's not another rule that says "user" or "group" can run anything.

%sudo ALL=(ALL:ALL) ALL

is pretty common and lets members of the sudo user group run any command they please.

To my knowledge there is no rule for "let someone run everything except /some/command. But I could be wrong. However, if your trying to do that then your probably approaching a security issue the wrong way.

1
  • Also be VERY VERY careful. The way your doing this is very dangerious. Some one could edit /some/random/command and execute anything they want, including rm / -rf or worse. – coteyr Jun 30 '14 at 11:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.