If you only wanted to allow a user to edit
/etc/fstab, you could do this in several ways:
- Make sure access control lists are enabled (
acl option in the
/etc/fstab entry for
setfacl -m user:joe:rw /etc/fstab.
- Add a
sudoers rule: run
visudo and add a line
joe ALL = sudoedit /etc/fstab
I recommend the sudo method because it makes it easy to audit who can do what.
However, if you allow a user to edit
/etc/fstab, then they can indirectly gain root by adding an entry that lets them mount an external or loop filesystem on which they've planted a setuid root binary.
It is rather weird to allow a user to edit
fstab only. If you want to allow users to mount removable devices, use
pmount (or rely on desktop environments).
If you allow a user to run non-whitelisted commands as root (“all other administrative tasks”), then you cannot prevent them from editing any particular file. At some point, you need to decide whether you trust these people or not. If you don't trust them to administrate your machine, don't give them privileges (make them use another machine, perhaps a virtual machine instead). If you do trust them, let them become root, and tell them that certain files are off-limits.