I have a limited user and access to root. How can I give that user the possibility to remove files owned by root?

I have the following line added in /etc/sudoers.d/john : john ALL=(ALL) NOPASSWD:/var/opt/OV/tmp/*yet I'm unable to perform touch or rm commands under /var/opt/OV/tmp. What do I need extra?

I don't know the syntax or how it should exactly be set, so the user john can execute only rm or touch under /var/opt/OV/tmp/. I'm thinking somewhere allong the lines Cmnd_Alias REMOVE=/bin/rm Cmnd_Alias CREATE=/bin/touch john ALL = (ALL) NOPASSWD: REMOVE, CREATE, /var/opt/OV/tmp. Let me know if this might work or if I need something added/removed. No, the chmod&chown commands will not help since the files under /var/opt/OV/tmp are owned by root.

  • 4
    That last bit of the line should be a command with optional arguments. Allowing someone to do rm /var/log/* using sudo would, in my humble opinion, be a really bad idea. It would be better to allow them to run a script (with no arguments) that deleted pre-selected files (or rotated them, even better). – Kusalananda Feb 22 '19 at 13:41
  • Could you please give an example? Is john ALL = (ALL) NOPASSWD: /var/log/* rm rf enough ? – Aiurea Adica tot YO Feb 22 '19 at 13:45
  • 2
    It's an especially bad idea because of the way sudo matches wildcards (across word boundaries) - man sudoers even warns against this specifically – steeldriver Feb 22 '19 at 14:01
  • 1
    surely more like john ALL = (ALL) NOPASSWD: /bin/rm -rf /var/log/* ? This totally wrecks the security of the server. John would be able to sudo rm -rf /var/log/../../etc and trash the server. – steve Feb 22 '19 at 14:01
  • 1
    Just because i am curious: Why should a normal user delete the files under /var/log? If you have storage limitations, consider the use of 'logrotate'. – gerhard d. Feb 22 '19 at 15:11

You can give an ordinary user permissions to remove files owned by root simply by giving them write access to the parent directory. No need for sudo.

In the example, you want the user to be able to delete files from /var/log, so you could change the permissions on that directory so your user could create (and therefore delete) files.

You might choose to do this by creating a new group that contained only your user, and changing the group ownership of the directory to match, and then adding group write permission.

chgrp johnsgroup /var/log
chmod g+w /var/log

Please note that I have not tested this suggestion, and it may be that the group write access is already required by some other application in order to write files to the directory. YMMV as they say.

|improve this answer|||||
  • Thank you for this suggestion, however, I would prefer these files to still be owned by root. I just need them removed by john under root's ownership. – Aiurea Adica tot YO Feb 24 '19 at 12:39
  • @AiureaAdicatotYO who said anything about the files being owned by john? I didn't. – roaima Feb 24 '19 at 21:10
  • It's the same as chown root:john and the group will be changed. I don't really need any modifications to the folder or files. – Aiurea Adica tot YO Feb 25 '19 at 7:29
  • 1
    I believe I found what I needed. setfacl -R -m 'u:john:rwx' /var/opt/ . – Aiurea Adica tot YO Feb 25 '19 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.