0

Need to allow a single user to delete folders / files within one directory, I have tried a few ways with and without alias but both ways it either prompts for a password or allows the user to remove in other areas ie /etc/ or /var/

Cmnd alias specification
Cmnd_Alias RMCLEAN = /bin/rm /tmp/testcu

# User privilege specification
root    ALL=(ALL:ALL) ALL
"NAME" ALL=NOPASSWD:ALL

# Allow members of group sudo to execute any command
#%sudo  ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d
%sudo ALL=(ALL) NOPASSWD: ALL
%wheel ALL=(ALL) NOPASSWD: ALL
cleanup ALL=(root) NOPASSWD: RMCLEAN

If I put a , between rm and /tmp Cmnd_Alias RMCLEAN = /bin/rm, /tmp/testcu it will allow me to delete with no prompt but in all areas.

  • I don't think there's any safe way to restrict rm like this. For example, sudo doesn't consider .. in a matching argument to be special so you could trivially sudo rm /tmp/testcu/../../etc/shadow. You'll be better off calling a custom script via sudo, so that it can sanity-check all its arguments before calling rm directly. – roaima Mar 4 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.