2

I would like to authorize wheel group to rm in a specific folder (in this case my folder is "CT").

I've tried to add this line in visudo:

%wheel All=(ALL) /bin/rm /CT/

I have a test files "test1" in CT folder and when I try to rm with wheel user, I get the message that I'm not authorized to run /bin/rm test1

  • I would like to allow rm * for all CT folder. There won't be sub folders, only files. Thx for your help – MLocci Jun 14 at 14:54
  • I was just testing but in the end there will be only files. My bad. – MLocci Jun 14 at 15:00
  • I didn't know I had to be this specific in sudoer file. I've just edited my question. Thx for your advices – MLocci Jun 14 at 15:08
  • You don't have to be this specific. But if you're only going to delete files why let people delete directories too? – roaima Jun 14 at 15:13
2

Since you only want to remove files from the /CT directory itself, this could be done without any reference to sudo.

Initially you need to set the group ownership and permissions as root:

chgrp wheel /CT
chmod g+rwx /CT

Now users in the wheel group have permission to (create and) delete any files in this directory without using sudo:

rm -f /CT/unwanted.txt
0

Your command allows wheel group users to run rm /CT/. Nothing more. Nothing less.

You could try this, which will allow users to remove /CT/ and anything inside it provided they use the exact same flags as specified here:

%wheel ALL=(ALL) /bin/rm -rf /CT/*

My general preference for sudo control is to write a script that validates the arguments, and have that script permitted through sudo. Perhaps something like this might suffice, which checks that the target is a file inside the folder /CT

#!/bin/bash
#
ss=0
for item in "$@"
do
    real=$(readlink "$item")
    if [[ "$real" =~ ^/CT/. ]] && [[ -f "$real" ]]
    then
        rm -f -- "$item"
    else
        [[ -t 2 ]] && echo "Refusing to remove '$item'" >&2
        ss=1
    fi
done
exit $ss

You can add other conditions to require the target to be a directory, to have particular ownership, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.