Basically I have an application server and would like to allow the Owners/Admins of the Application to be able to run any sudo command on the directories related to the application. For example, if the application directory is /opt/my-application, the user would not be required to run "sudo vim /opt/my-application/some-file" but would to run "sudo vim /var/some-file"

I thought that the right way to go about it would be to determine which commands they frequent in the applications directory, but I feel that would still allow them too much power else were in the system.

Edit September 11th: Seeing some of the answers, I figure I should clarify my question. At this moment, the users have sudo access. I'm not opposed to them having sudo access to do the job they need. What I am curious about is a potential solution I can put in place to make it easier on them to work in the very specific directories they would regularly modify. My hope was I could enable passwordless sudo for any command they would run on those specific directories. The answers thus far have helped me implent passwordless sudo for a few system commands they would need, such as systemctl to be able to manage the application.

  • 1
    This is a very bad idea. Don't expect a solution to perfectly prevent those users from escaping your little sudo jail. You should instead change permissions on that directory and if you must, write scripts elsewhere on your system and set a SUID bit on them for those users to run (and NOT edit)
    – Pheric
    Sep 10 '20 at 23:43

In your sudoers file:

user ALL=(root) NOPASSWD: /usr/bin/vim /opt/my-application/some-file

This line only will be allow the specific command to run.

But you cannot change the permissions to directory (chmod or setfacl)? Or change default umask value?

  • :shell bingo :-(
    – roaima
    Sep 10 '20 at 18:05
  • Could add -Z to the command to restrict shell-outs. Sep 11 '20 at 17:35

For file access, the right way to go is to set up the permissions to allow that file access. Set up a cron job if necessary to enforce retrospecively the permissions and ownerships of newly created/modified files.

For specific requirements (restarting Apache/NginX maybe), write a shell wrapper script that calls itself via sudo and runs the appropriate commands under tight control.

  • This is a new one to me. Would you be able to shed some light or resources I could use to learn about this. I think I understand the premise, but would not know where to begin.
    – Servontius
    Sep 10 '20 at 19:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.