2

Is it possible to give a single user without sudo access, the ability to run a sudo protected command like chmod?

5
  • 3
    This doesn’t answer your question, but I think it’s worth pointing out that allowing a user to run chmod as root in one way or another, without filtering what they can do with chmod, is effectively equivalent to granting them full root access. Oct 26, 2021 at 7:41
  • yeah, is it chmod, or something else? Because as Stephen Kitt says, you can't give someone access to chmod without effectively allowing them to become root. There's other things that might be safe. Might be worth talking about the problem you're solving, more than about what you consider a good solution at this point! Oct 26, 2021 at 8:25
  • What does it mean, "sudo protected"? I can run this command with my credentials.
    – K-attila-
    Oct 26, 2021 at 8:57
  • why not limit sudo for a specific user to a single command (or even a group of commands) you want him to be able to run ?
    – golder3
    Oct 26, 2021 at 13:11
  • @golder3 That is basically what I want, but how to limit sudo for a specific user?
    – RnRoger
    Oct 26, 2021 at 14:53

1 Answer 1

5

sudo configuration files are stored in /etc/sudoers file and /etc/sudoers.d directory. It is preferable to add a file, with the same name as the user you want to set the sudo for, to /etc/sudoers.d although you can also edit /etc/sudoers.

The basic syntax is who where = (as_whom) what

For example:

root ALL = (ALL:ALL) ALL

menas allow user root to run on any host (ALL = ) as any user:group (ALL:ALL) any command (ALL)

In your case, you need to do something like:

echo "ltd_user ALL=NOPASSWD:/bin/cat, PASSWD:/bin/chmod" > /etc/sudoers.d/ltd_user

This gives user ltd_user rights to run cat without typing password and chmod after typing password, on any host, as any user

After making a file under /etc/sudoers.d you should set permission to 440

chmod 440 /etc/sudoers.d/ltd_user

Also note that I gave a very basic example (and hence used echo and redirection) but it would be good practice to use visudo command to edit sudo configuration files, which ensures that only one person is editing the file at a time, has the proper permissions, and refuses to write out the file and exit if there are syntax errors in the changes made.

visudo -f /etc/sudoers.d/ltd_user

see man sudoers for more details and advanced examples

Not the answer you're looking for? Browse other questions tagged .