0

First, sorry in advance, I know there are a billion of these questions but nothing worked for me...

I got a certain file in a directory that shall not be deleted by a sudo user. I know that sudo is supposed to to everything, that is the point of that group but maybe there is a solution

I was thinking about restricting the types of commands sudo can do (in the /etc/sudoers file) but first, it would not really solve anything, and second, it didnt work somehow by using the following example:

%wheel ALL=(ALL) ALL, !/usr/bin/rm

I tried using different groups, my username, etc., and I could not even restrict a command for my own user

In summary, is there any way I can prevent a sudo users to type certain commands such as rm -rf name_of_folder instead of preventing the access to the entire rm command or any other solution? Maybe it is even possible to ask for a password when typing a certain command?

2
  • 1
    You'd need to use SELinux. See here: blog.siphos.be/2015/07/restricting-even-root-access-to-a-folder Commented Sep 12, 2022 at 19:17
  • You will also need to restrict access to unlink and link -f for the obvious ways to overwrite the files. Next you'll need to restrict editors to prevent deleting the file's contents. You also will have to watch out for cp /dev/null ... and truncate. The list goes on. sudo is good for allowing certain access but is very bad at disallowing operations. There are so many ways in Linux/Unix to make a certain operation happen that you really cannot prevent a bad operator.\
    – doneal24
    Commented Sep 12, 2022 at 19:40

1 Answer 1

0

In summary, is there any way I can prevent a sudo users to type certain commands such as rm -rf name_of_folder

Nope, because you can only express simple matching against command and args in sudoers, and it's very easy for users to escape them. For instance they could try rm -v foo, rm -- foo, rm foo -r and so on. It would depends on the exact interface of every command and sudo does not understand them.

instead of preventing the access to the entire rm command or any other solution?

That's the usual alternative. You prevent access to rm, but you provide access to your own restricted command, usually a shell "wrapper" around the targe command.

But it's hard to write a restricted command right, and it's a high security risk. I suggest you start with a command with no args, which makes sure it ignores stdin and its environment, and give root access to your users thru sudoers. Then maybe add 1 arg and be very pedantic about its interpretation, especially if it's a path.

The most basic restricted command would be a /usr/local/bin/restricted_rm like :

#!/bin/sh

exec </dev/null
/usr/bin/env -i rm -rf /absolute/path/to/folder

Try to adjust your process/interface with your users to see if such a simple script can do the trick, it's worth it. Otherwise you've been warned with more complex "filtered" restricted commands, it's a serious security hazard. Even if you know what you're doing. Been there.

4
  • A script would definitely suffice. But unfortunately I dont understand the script, I am not very sophisticated and I dont know what to look for in the Internet. In addition, why didnt my restriction work in the sudoers file? If this works, maybe I can use chattr +i and restrict the access to that command?
    – user541118
    Commented Sep 13, 2022 at 6:21
  • @Newton_co A script would definitely suffice. Not really. They're almost impossible to get secure. For example, does the shell script currently posted source startup or termination scripts such as .bashrc? If so, those files can contain any commands the user wants. And the currently-posted script looks vulnerable to environment attacks via LD_PRELOAD, IFS, and PATH environment variables. And those are just off the top of my head. Trying to give someone "just a little bit of root" is HARD. Have you even thought about someone simply renaming your file with mv yet? Commented Sep 13, 2022 at 23:35
  • @AndrewHenle where do you learn all this? Do you have a book recommendadion. And regarding my problem: it is a very special application, this file will not be renamed and the simplest solutions, such as a script, works in my case. I just dont know how to apply it
    – user541118
    Commented Sep 14, 2022 at 5:11
  • Totally seconding @AndrewHenle
    – zerodeux
    Commented Sep 14, 2022 at 11:59

You must log in to answer this question.