how to restrict some commands for admin in Linux(CentOS)

I tried to use visudo in root , and write

ABC ALL=ALL,!/bin/rm,!/bin/sudo

to restrict the "ABC" user not to remove some important files.

It worked very well in ABC user ,Linux denied my commands when I type sudo rm -rf /etc/ or remove something important files that need super user.

But there is a problem in script.If I write a script about sudo rm -rf /etc/, this script worked and deleted my /etc/ by using sudoto execute.

So visudo seemingly can't not work in script.How should I do ?

I need my admin user can use all commands but can't delete my system files.

  • 3
    You should re-think your approach. Negative patterns don't work, a user with sudo privileges can do things like rename rm to something else then sudo it, or compile a program that uses unlink(2) to do the same thing. Use sudo to state what is allowed, not what is forbidden. – Satō Katsura Sep 15 '17 at 16:29
  • 1
    @SatōKatsura Negative sudo patterns do work, just not like OP has in mind. Negative patters in sudo are used for exceptions to wildcard rules. The example from the man sudoers page: pete HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root This lets "pete" change the password of anyone except root. – Centimane Sep 15 '17 at 16:32
  • 1
    It's not that they don't work, it's that they're quite likely to be totally ineffective as described unless you blacklist each and every possible means to do an end-run. I can cp /bin/sh ~/mysh, run sudo ~/mysh since it isn't blacklisted, and now I have a straight-up root shell. – DopeGhoti Sep 15 '17 at 16:51
  • 1
    That was rather my point, as I explicitly showed an example for. I was drawing the distinction between the actual blacklist not working and being an effective tool. They do work. They're just not useful in any practical or effective way. The only real answer to this in my opinion is "do not put a user into sudoers whom you would not trust with unfettered root access to your system without an explicit whitelist of specific commands to run in a privileged environment". – DopeGhoti Sep 15 '17 at 17:08
  • 1
    @DopeGhoti They can be an effective tool is my point, just not on their own. The example from the man sudoers page: pete HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root This lets "pete" change the password of anyone except root. Their purpose is to make wildcard/regex usage more practical, not to stand on their own. – Centimane Sep 15 '17 at 17:15

I need my admin user can use all commands but can't delete my system files.

This is not possible (in particular if you want to protect from some malicious Linux expert), because the root uid 0 has or can get all privileges. However, read also capabilities(7) (Linux specific).

If you want to simply avoid mistakes, you might use chattr (for the immutable flag). But a determined admin could still remove such "immutable" files (by first removing the immutable flag).

(I guess you are mostly concerned by junior admins making trivial mistakes, not by malicious hackers)

I suggest instead to backup regularly your /etc/ (perhaps on some remote machine), which is always a good thing to do. And you could also have your own rm (as an alias, a function, another executable ....), and decide to version-control /etc/ (e.g. with git, see etckeeper)

Read also about setuid executables and setreuid(2) (and of course execve(2)....) system call (this mechanism is the basic brick of protection on Unix, and is used by sudo & su & login).

BTW, trust is mostly a social issue, and wanting purely technical solutions to social issues is unwise and naive.

  • 1
    Rather than something like chattr I would recommend a read only filesystem. Again a determined person could remount it, unless you're read-only filesystem was literally read-only media (which would make it a pain to maintain). – Centimane Sep 15 '17 at 16:34
  • 1
    Also, in a sense this wouldn't be the worst way to remind people who essentially have root access they shouldn't delete things. Sure they can get around it easily, but it could serve as a reminder they shouldn't. In which case this is similar to just aliasing rm to echo "you shouldn't be deleting things!" for root – Centimane Sep 15 '17 at 16:39
  • @Centimane: it really depends on the circumstances. I know I like to chattr +i my unmounted mount points and ssh/TLS private keys, where a r/o filesystem would be overkill. – Ulrich Schwarz Sep 15 '17 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.