How to configure a user in sudoers such that the user can install app and can't access a specified directory

Question

I want to add a user to sudoers, such that the user can do anything in root permission but:

1. The user can't use mount command;

2. The user can't access(read or write) to directory /home/protecteddir;

thanks you all very much for the help :)

Answer 1

To restrict the sudoers from mounting, modify your sudoers file as in,

#limit users in group 'sudo' from mounting
%sudo ALL=(ALL) ALL, !MOUNT

To protect a directory from a sudoer, you can try setting using ACL, further information can be found here,

I am not sure this will work since sudo is almost a root access

Setting Access ACLs