I want to block the sudo users from changing password of root. How is it possible?
If you're talking about users who are only allowed to run a few specific commands that you have chosen to whitelist--after making sure they cannot be used to achieve things you want to prohibit--then, as Raman Sailopal says, the solution is simply to not include whatever commands you don't want those users to be able to run as root.
In particular, users don't need to be root to run the
passwd command to change their own passwords, so depending on your specific needs, it's likely you don't need to give them the ability to run any
passwd command as root with
However, if you are looking for an effective way to restrict the ability of users whom you have allowed to run any command at all as root with
sudo from running just some specific commands you consider dangerous, then the answer is that there is no effective way to achieve that, and you should instead reconsider if you ought to be giving those users the powers that you are now giving them. Even if you were to disallow specific commands, users who could run any but a few blacklisted commands as root with
sudo could simply achieve the exact same goal using other commands.
Limitations of the ‘!’ operator
It is generally not effective to “subtract” commands from ALL using the ‘
!’ operator. A user can trivially circumvent this by copying the desired command to a different name and then executing that. For example:
bill ALL = ALL, !SU, !SHELLS
Doesn't really prevent bill from running the commands listed in SU or SHELLS since he can simply copy those commands to a different name, or use a shell escape from an editor or other program. Therefore, these kind of restrictions should be considered advisory at best (and reinforced by policy).
In general, if a user has sudo ALL there is nothing to prevent them from creating their own program that gives them a root shell (or making their own copy of a shell) regardless of any ‘
!’ elements in the user specification.
This is a special case of the more general principle that you cannot give someone the ability to perform arbitrary actions in a system while effectively limiting them by attempting to prohibit some narrow actions. At least you cannot do so merely by blocking the common mechanisms that are used to perform them. They can always find another way, and they may well do so. They may find another way even by accident, so you probably cannot effectively fight even their carelessness in this way.
Furthermore, if you have users whom you want administering the system, but whom you don't trust to accede to your demand to refrain from changing the root password, then do you really trust them in any of the ways that actually matter? Do you really trust them with all the other abilities they have, most of which are vastly more destructive? As I wrote in my answer to What stops someone from setting root password? about administering Ubuntu systems (where, by default, membership in the
sudo group confers administrative powers):
You are a member of the
sudogroup. You can delete all the files on the system. You can write raw data to the hard disk, overwriting what is there irrecoverably. You can access other users' files, even if they have set restrictive permissions. You can install new firmware to your physical devices. You can dump users' passwords from the shadow database and attempt to crack them, or just reset them. You can install malware that infringes users' privacy or destroys data, including keyloggers and ransomware. You can do some really weird stuff with your network interfaces. You can make the system misinform users about the security of their communications. You can cover your tracks. You can hand all these powers, and others I haven't listed, over to people who will use them for evil. When it comes to misusing
sudoor Polkit, those are the kinds of things you should be concerned about.
It is true that you shouldn't let untrusted people into your house unsupervised, but the reason why is not that they could then unlock the door from the inside and get in.*