I have been trying to use the following in visudo to restrict a user from using the following commands and going into another directory , but this doesn't seem to work

myuser ALL=!/home/ubuntu,!/usr/sbin/service,!/usr/bin/apt,!/usr/bin/vi,!/usr/bin/touch

I have saved the visudo and changes are well reflected in sudoers. what am i doing wrong in here?


This is expected behaviour, the sudoers file is only consulted when you run sudo so it denies the user access to the command and gives you the relevant error message.

sudo su
Sorry, user xxxx is not allowed to execute '/bin/su' as root on yyyyy.

When the user tries to run the command directly, sudo is not involved so you get the error messages produced by the individual commands failing because the user lacks privilege.

You can prevent a user from running a specific file by preceding the file with a bang (!), however you cannot stop a user from copying the file to another location and then running it from there.

  • but i am restricting the user from using vi, touch, apt, services & still they are able to do so – Kittystone Nov 23 '16 at 7:56
  • i edited the answer – Wissam Roujoulah Nov 23 '16 at 8:04
  • okay so , will creating a freebsd jail be the only option to overcome such kind of issue where i need to user just to execute specified commands and traverse specific directories that i mentioned ONLY – Kittystone Nov 23 '16 at 8:12
  • SElinux though is a possible way, although it does take a lot to learn. – Wissam Roujoulah Nov 23 '16 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.