I want to give root's permission (or root account) to my test's user not using wheel-group or sudoers on CentOS 7. Instead I would like to use module pam_cap.so and linux capabilities.
I try this:
Add module pam_cap.so in /etc/security/su:
# %PAM-1.0 auth optional pam_cap.so auth sufficient pam_rootok.so ....
Create file /etc/security/capability.conf and add allowed capabilities for user:
cap_sys_admin,cap_dac_override myuser * none
Then I run the following
$ su - myuser
I can verify this user's capabilities using:
$ capsh --print
As I understand for root's permissions it's also necessary to set capability bit for programs in /bin. For example, if myuser will delete files in which root is owner, I can set cap bit on /bin/rm:
sudo setcap 'CAP_DAC_OVERRIDE+ei' /bin/rm
But in this case its necessary to set different kinds of capabilities on all programs in /bin. And it's not good way.
Is it possible give root's permissions to user in just one step, setting some required capabilities? For example, its may be setting cap bit only on user's shell?