4

Consider the following line in a /etc/sudoers file:

username ALL=(ALL) ALL, !/usr/bin/passwd

as far as I know, this allows user username to use sudo, unless he not uses /usr/bin/passwd. But apparantly the user is still able to get a root shell using sudo -s/sudo -i and do whatever he likes. Have I understood this correctly? What would be a better configuration if I indeed want to disallow the user to change any password as root.

Improve this question

2 Answers 2

Reset to default
4

Without using additional security levels like SELinux, you cannot do this. But then it is a bad idea too, since there are really a lot of other possibilities to lock other user out if one can get (nearly full) root rights via sudo.

See https://serverfault.com/questions/36759/editing-sudoers-file-to-restrict-a-users-commands

Improve this answer
3
  • Thanks for your reply! Would then a whitelist approach be effective, i.e. only allow him to use aptitude, or would it still be possible to get a root shell?
    – moooeeeep
    Apr 17, 2012 at 13:28
  • 2
    A whitelist could work. But you need to know all features of the allowed programs: For example, if a user (re)installs/updates a package which want to overwrite an existing configuration file, a option is provided to run a shell with full root-rights to "resolve" this issue... I do not know how the new PackageKit, which can be configured via Policykit such that normal user can install packages, handle this case. Beside this, the user can install unsafe software and exploit it to get root access.
    – jofel
    Apr 17, 2012 at 14:26
  • The gtfobins list tells you what you can do when given access to some restricted programs (for example access to apt-get can be used to show info with less, which can be used to run arbitrary shell commands using a ! command).
    – dubek
    Feb 1, 2021 at 9:54
2

You can do this with Cmnd_Alias record. In your case solution will be like:

Cmnd_Alias PASSWD = /usr/bin/passwd
username ALL=(ALL) ALL, !PASSWD
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .