# How to limit administrative privileges to various config files?

I want one administrator to be able to edit the /etc/fstab file but one administrator to not be able to edit the fstab file.

Is this possible?

I am assuming I would need to somehow setup what files "sudo" gives them access to. Or possible just make non administrative accounts and then create a group called fstab-access and add one of the users to that and setup privileges for that group... ? Am I on the right track?

If you only wanted to allow a user to edit /etc/fstab, you could do this in several ways:

• Make sure access control lists are enabled (acl option in the /etc/fstab entry for /), and setfacl -m user:joe:rw /etc/fstab.
• Add a sudoers rule: run visudo and add a line joe ALL = sudoedit /etc/fstab

I recommend the sudo method because it makes it easy to audit who can do what.

However, if you allow a user to edit /etc/fstab, then they can indirectly gain root by adding an entry that lets them mount an external or loop filesystem on which they've planted a setuid root binary.

It is rather weird to allow a user to edit fstab only. If you want to allow users to mount removable devices, use pmount (or rely on desktop environments).

If you allow a user to run non-whitelisted commands as root (“all other administrative tasks”), then you cannot prevent them from editing any particular file. At some point, you need to decide whether you trust these people or not. If you don't trust them to administrate your machine, don't give them privileges (make them use another machine, perhaps a virtual machine instead). If you do trust them, let them become root, and tell them that certain files are off-limits.

If you give them access to everything, then obviously all bets are off. However, you can allow a user to edit a particular file and nothing else. For example:

user ALL = sudoedit /etc/fstab


Would allow the user to only edit /etc/fstab.

• NICE!!! Is there some basic instruction somewhere on how to implement this? Is this a terminal command? TIA – Joshua Robison May 1 '13 at 23:06

If you try to enumerate every single utility that an administrator may need to use you'll be sitting at the keyboard for a while.

Technically, this sort of desire is why Linux capabilities were developed. To do what you're wanting: you could give the users particular capabilities and then just give user1 write access to fstab (via ACL or something) and just not give that same write privilege to the restricted user2 (making sure user2 didn't have CAP_CHOWN or CAP_DAC_OVERRIDE) but given the current state of capabilities (in terms of how well developed the userspace is) it's probably more work than it's worth.

Without using capabilities to devolve responsibilities into a "root as user role" scenario, you just have various permutations of using the root account to do stuff with. That brings us to the aforementioned problem of telling the system each and every possible tool the other user needs (hopefully one that can't be indirectly used to manipulate fstab).

You're probably better off just deciding whether you can trust a particular user to be an administrator or not.

• What I want to do actually is have an administrator that has like two or three config files that they are not allowed to touch... The problem is, they have access to everything via sudo. – Joshua Robison May 1 '13 at 13:23
• Yeah, capabilities were designed to give the admin that level of expressiveness in privilege management and the ability to directly target operations rather than specific binary tools. Capabilities give you what you're after but they're too hard for a system administrator to implement in a way that's practical. Until distros develop something for you the name of the game is "trust them with super admin" or "let them run particular programs as super admin." You might consider giving the restricted user only a few sudo commands and just giving more commands as they complain about this or that. – Bratchley May 1 '13 at 14:06