I have a linux development servers with some projects in home folders belonging to different users. Due to the nature of the server, some users can do sudo -s for some administrative task. Is there any way I can prevent users from snooping other home folders (or a specific folder)?
If someone can run arbitrary commands as root, then they can switch to any user account, so they can do whatever that user can do.
In practice you have three options.
- The privileged users only need to perform very specific tasks. Then let them only run some specific commands with sudo. This is secure only if those commands don't allow “shell escapes”, i.e. if there's no way to leverage those commands to execute other programs. For example, package management (allowing
sudo apt-get install …) often allows shell escapes by injecting the commands inside a package (this can be ok if package signatures are checked properly from known sources).
- The privileged users need administrative powers, but they don't need it on the “real” computer, all they need is to have it on some computer (e.g. to play with network settings). Then create virtual environments (e.g. a virtual machine, or an lxc container, or an ad hoc Linux namespace) for the privileged users, and don't make other users' data available in the virtual environments.
- Use social rather than technical controls: give the users broad permissions but let them know that any violation of privacy will be harshly dealt with. This is often ok if the users are employees, but it depends on how sensitive the data is.
If a user runs a command with
sudo then they are running the command as if they were root, because they are root. So you cannot prevent a user that can use sudo from switching to a directory.
If you don't want users to access files in a directory, you can't give them root access on the machine.
Depending on what they need to be able to do, you can give them sudo access to only certain commands by dropping a line like this into your sudoers file:
%devgroup ALL=(ALL): /bin/commandname
which would make it so members of the group devgroup can only execute /bin/commandname as root (and of course with this particular example, you'd also want to remove them from the wheel group).