i have a hypotetical problem. Assume that I want to educate a kid aged 7 on linux. I do not want him to waste time with youtube kids channels. So I enforced an extension on chrome that blocks these kind of channels. But while learning linux, he might want to delete force installation config files of extension. How can I give him sudo privilege (so he can learn linux with full experience) while preventing him from deleting that config file?

For some cases he could learn workarounds for situations involving being sudoer: Example: for sudo apt install he can actually download source code and compile and install whatever he wants.

But he cannot modify /etc/resolf.conf as a non sudoer.

As far as I know, 2 different sudoers can modify each other's files.

Last but not least, I do not want to change owner of files of OS. What is the correct version to do this?


What you are asking for is quite impossible, as you are trying to subtract commands from the ALL set. Blacklisting commands for a root-like administrator is fairly impossible and so does man sudoers explain in detail:


Limitations of the ‘!’ operator

It is generally not effective to “subtract” commands from ALL using the ‘!’ operator. A user can trivially circumvent this by copying the deired command to a different name and then executing that. For example:

bill    ALL = ALL, !SU, !SHELLS

Doesn't really prevent bill from running the commands listed in SU or SHELLS since he can simply copy those commands to a different name, or use a shell escape from an editor or other program. Therefore, these kind of restrictions should be considered advisory at best (and reinforced by policy).

In general, if a user has sudo ALL there is nothing to prevent them from creating their own program that gives them a root shell (or making their own copy of a shell) regardless of any ‘!’ elements in the user specification.

What you could consider:

  1. Define a whitelist instead of a blacklist.
  2. Run the OS in a VM, then restrict the website accesses via the host.
  3. Restrict Web access via firewall settings in the router.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.