Grant group A's members 'sudo su' access to group B's user accounts

Question

Assume I have a collection of unprivileged users (user01, user02, user03, ...) who are members of a Linux security group called 'x_users':

$ groups user01
user01 : user01 x_users

Further, assume I have a collection of admin users (admin01, admin02, admin03, ...) who are all members of a Linux security group called 'x_admins':

$ groups admin01
admin01 : admin01 x_admins

I want each member of the x_admin group to have the ability to use sudo(8) and su(1) to invoke an interactive login shell as any user who is a member of the x_users group, e.g.,

[admin01 ~]$ sudo su - user01
[user01 ~]$ # do stuff as user01
[user01 ~]$ exit
[admin01 ~]$

Members of the x_admins group may not use sudo(8) and su(1) to invoke an interactive logon shell for any user who is not a member of the x_users group:

[admin01 ~]$ sudo su - nonxuser
[sudo] password for admin01:
Sorry, user admin01 is not allowed to execute '/bin/su - nonxuser' as root on localhost
[admin01 ~]$

One way to accomplish this is to create a config file '/etc/sudoers.d/x_admins' as follows:

# /etc/sudoers.d/x_admins
User_Alias ADMINS = %x_admins, %wheel
ADMINS   ALL = (root) /bin/su - user01
ADMINS   ALL = (root) /bin/su - user02
ADMINS   ALL = (root) /bin/su - user03
# ...

Of course, manually listing the individual members of the x_users group in a sudoers config file is tedious and error prone. Is there a more concise way of accomplishing this in the sudoers config file?

Answer 1

One way to achieve what you want more tightly is to allow users of the admins group to use 'sudo' directly to run commands as users of the users group. This could roughly be done by adding the following to /etc/sudoers:

%x_admins ALL = (%x_users) ALL

An admin could then then run commands for user 'user0' with the following:

sudo -u user0 command...

To get full shell access to that user the admin could use the following:

sudo -i -u user0

This way you don't let the admins run anything as root, not even 'su'.