I want to give a list of users or certain group on my CentOS 6.7 server with sudo permission but no access to just this file /root/database.yml Is that possible ? The file actually has a password which i do not want anyone to see except for me. Any suggestion or help is greatly appreciated.
sudo program allows you to limit what a user can do. The policy is in the file
/etc/sudoers. If you want to allow certain operations only, write a script that only implements those and restrict them to only running that as the command. To be sure that the security is what you want you probably need to understand the
sudoers man pages.
No, you can't do that. If you give root permissions to someone, they can do everything, including reading and writing every file. Even if there was a way to somehow exclude
/root/database.yml, root could still change the sudo configuration, replace the sudo binary, access the disk directly, etc.
If you don't trust your fellow administrators, don't store any secrets on the machine.
If you want to both store a confidential file and have administrators who can't read that file, then the file must be stored on a different machine from where those people are administrators. The different machines can of course be virtual machines or containers, they don't have to be separate physical machines.
So put all the services that you want your fellow administrators to manage in a virtual machine or container, and make them root in the VM/container. Keep the confidential file
/root/database.yml on the host, and don't give out any root permission on the host.