I want to create group and want to allow the group to run all available commands except few commands. Can you please help me configure sudoers for the same.

I checked but only found how to allow some commands. But I want to restrict some commands and allow remaining all.


  • The problem in allowing “all commands except a few” through sudo is, your users will almost certainly be able to use the allowed commands to create aliases or renamed copies of the forbidden commands... which will then be allowed. So such a restriction will be very weak and easy to bypass.
    – telcoM
    Jun 13 '20 at 18:30
  • You do understand that sudoers is considered ONLY if $USER prefaces her command with sudo, right?
    – waltinator
    Jun 14 '20 at 2:33

You have to use the ! operator. See the details in the man page.

Note, from the same manpage the following security note:

Limitations of the '!' operator

It is generally not effective to ''subtract'' commands from ALL using the '!' operator. A user can trivially circumvent this by copying the desired command to a different name and then executing that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.