I want to give a list of users or certain group on my CentOS 6.7 server with sudo permission but no access to just this file /root/database.yml Is that possible ? The file actually has a password which i do not want anyone to see except for me. Any suggestion or help is greatly appreciated.


Yes, the sudo program allows you to limit what a user can do. The policy is in the file /etc/sudoers. If you want to allow certain operations only, write a script that only implements those and restrict them to only running that as the command. To be sure that the security is what you want you probably need to understand the sudo and sudoers man pages.

  • thx for ur reply but Is it possible to do like all permission but access to /root/database.yml is what i am looking for ? – dev_marshell08 Aug 4 '16 at 2:36
  • If you just want to deal with access to one file, that's exactly what normal UNIX permissions do. You create a group, put the affected accounts in it and set the file to that group and the group permissions to what you want. – MAP Aug 4 '16 at 4:34

No, you can't do that. If you give root permissions to someone, they can do everything, including reading and writing every file. Even if there was a way to somehow exclude /root/database.yml, root could still change the sudo configuration, replace the sudo binary, access the disk directly, etc.

If you don't trust your fellow administrators, don't store any secrets on the machine.

If you want to both store a confidential file and have administrators who can't read that file, then the file must be stored on a different machine from where those people are administrators. The different machines can of course be virtual machines or containers, they don't have to be separate physical machines.

So put all the services that you want your fellow administrators to manage in a virtual machine or container, and make them root in the VM/container. Keep the confidential file /root/database.yml on the host, and don't give out any root permission on the host.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.