How can I restrict sudo access to a specific user in the /var directory or its contents?

  • sudo is used to restrict access to commands, rather than specific directories. Can you describe in a bit more detail what you're trying to achieve? What commands do you want this user to be able to execute or what actions are they trying to carry out? – EightBitTony May 11 '16 at 10:06
  • i have an objection that sudo user must not be able to view and edit logs. so that i need to restrict sudo user to change directory to some specific directories. – Khansb May 11 '16 at 10:14
  • 5
    read this and this. – Rahul May 11 '16 at 10:14
  • What do you want the user to be able to do as root? – Jeff Schaller May 11 '16 at 10:47

sudo allows regular users to run commands as root. Unless you provide an explicit list of very specific commands it is virtually impossible to prevent a user with sudo access from doing anything they like (and subsequently covering their tracks) with content that doesn't leave the server.

Your question is usually triggered by people who don't really grasp what sudo is doing.

So, the only way to achieve what you want using sudo is to limit the configuration to specific commands that don't accept any parameters.

sudo gives users root access (to everything, or to a subset of commands or to everything with some commands excluded).

If you don't trust users not to modify logs, then don't give them sudo access, because sudo access is just root access unless you're exceptionally careful and provide only specific commands (usually scripts) which achieve single specific goals.

  • okay... what about if we restrict user on command level. like we say a user can not use vi and rm commands – Khansb May 11 '16 at 10:53
  • 2
    Then you're in an arms race with people you gave root access to but don't trust. If you allow sudo access to cp then people can use it to copy vim to a binary called bob and launch it. The only safe way is to explicitly include commands, not exclude unsafe ones, but even then you have to be careful (can't give them chmod for example, because it can be exploited to give them access to anything). – EightBitTony May 11 '16 at 11:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.