I am new to system administration. We have a lab set up where we have a server and client machines. The client machines have LDAP users which has the work area for all the users in the centralized server. So whenever an user logs in, his work area will be mounted through the NFS service in the client machines and all his work will be saved to the server when he logs out.

Now, I want to give a local user in the server limited root access. I want this local user to be able to view the home directory of all the LDAP users and nothing else. I believe I am looking for wheel user in the server. I also believe I should make some changes in the visudo file to allow limited root access to the local user in the server.

user1, %operator ALL= /home/users

I tried adding the above command in the visudo file for the local user user1. I also added the user to the wheel group like below.

usermod -G 10 user1

However, I do not see any changes. Why didn't my approach with sudo work?

Since this approach doesn't seem to be working, I asked: Allow a user to read some other users' home directories

  • why did you think that line in sudoers would help? i forget the exact syntax but it looks like that works for the operator group, not wheel.
    – strugee
    Commented Sep 19, 2013 at 20:04
  • and did you read man sudoers?
    – strugee
    Commented Sep 19, 2013 at 20:05
  • yeah. I am editing the sudoers file by running the command visudo. The file is /etc/sudoers. I am adding the line user1, %operator ALL = /home/users in the sudoers file. However, I do not see any change for that particular user (user1).
    – Ramesh
    Commented Sep 19, 2013 at 20:07
  • I know. You said that in your question. I'm asking if you read the documentation before coming here.
    – strugee
    Commented Sep 19, 2013 at 20:28
  • @Ramesh local user is ldap user or not ? Commented Sep 19, 2013 at 21:01

3 Answers 3


Couple of things:

  1. The command sudo is for elevating yourself to a higher level of credentials for either a command or set of commands, not for gaining access to a directory with which you (1) aren't either the owner, (2) in a group that has read permissions to said directory, or (3) the directory doesn't have the other permissions opened to the world.

  2. The file /etc/sudoers is the file that contains all the rules for a given system and stipulates which users, groups of users, can run which commands in an elevated way as root, typically, or some other user account. You typically do NOT want to edit this file directly, though you can, it's best not to do so.

  3. The command visudo is the prescribed way for editing the /etc/sudoers file.

  4. If you want to see what sudo credentials a user has access to, the simplest way is to become that user and run the command, sudo -l.

    $ sudo -l
    Matching Defaults entries for saml on this host:
    LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
    User saml may run the following commands on this host:
    (ALL) ALL
    (root) NOPASSWD: /usr/lib/jupiter/scripts/bluetooth, (root) /usr/lib/jupiter/scripts/cpu-control, (root) /usr/lib/jupiter/scripts/resolutions, (root)
    /usr/lib/jupiter/scripts/rotate, (root) /usr/lib/jupiter/scripts/touchpad, (root) /usr/lib/jupiter/scripts/vga-out, (root) /usr/lib/jupiter/scripts/wifi

wheel access

I believe you're referring to the users' group wheel, which is an old way (to my knowledge) way of granting users permissions to become root via su -. This article does a good job of discussing the use of this group, titled: Administering your Linux system.

Granting access to /home/<user>?

To my knowledge there is no systematic way to do this without giving this user elevated privileges in other ways that you're trying to limit. I would say that if you do not trust this particular user the responsibility of having access in this fashion then they are probably not the right person to be doing this work!


For example. Say I have 2 students and 1 TA. Students (user1 & user2) TA (user3).

So the groups would be as follows:

  • class1
  • vboxuser1

So when I logged into the system as any of the above users (1-3), my groups would be as follows:

$ groups
users vboxusers class1

This groups would also need to be set on the student's home dirctories:

$ ls -l /home/user1 | head -3
total 37784
drwxrwxr-x   2 saml class1     4096 May 16 22:02 alsa
drwxrwxr-x  31 saml class1     4096 Mar 26 12:09 apps

This is just one idea, it has issues with this approach, but given the information you've provided is "one way to do it"!

  • ok, I get it. I have LDAP users whose home is located under /home in the server. For example, if I have 2 LDAP users (user1 and user2), I have the following folders in the server. /home/user1 and /home/user2. I am creating a local user in the server (serveruser). Now I need to give permissions to serveruser to view /home/user1 and /home/user2. Is it possible anyways in Linux?
    – Ramesh
    Commented Sep 19, 2013 at 20:40
  • @Ramesh - as I stated, there is no way to do this easily. You could for example use Access Control Lists (ACLs) but this would then require that you systematically apply these to each user's /home/user# directory for user serveruser. This is typically not done because it becomes a maintenance nightmare. If you don't trust this admin, then find another one that you do.
    – slm
    Commented Sep 19, 2013 at 20:43
  • It's not that I do not trust the user. I am the system administrator in the school. So, I want to give the permissions to the /home directory to the teaching assistants to evaluate the homework assignments of students. So, I kind of need to give access to the user without giving the root password to him.
    – Ramesh
    Commented Sep 19, 2013 at 20:45
  • Is there a group that is common to the various groups of users that aligns with the teaching assistants? I would assign the TA's to this group as well, then they would be able to gain access to these groups without issue. ACLs would be your other option, but this would require you to apply the TA's username as having read access to a variable group of /home/user# directories.
    – slm
    Commented Sep 19, 2013 at 20:47
  • Yeah. All the students in the lab belong to the "vboxusers" group. Now, are you suggesting me to create user accounts for the GTA's in the vboxusers group? After I create user accounts how can I make the TAs view other users folders too?
    – Ramesh
    Commented Sep 19, 2013 at 20:50

Now, I want to give a local user in the server limited root access.

This sounds like a bad idea.

First, there's the issue of data privacy - if you don't trust this user to have full root permissions, why do you trust him with the data of your users?

Secondly, even if you would somehow manage to grant this user limited root access to /home (which I don't think is possible), there are now several ways for him to gain full root access that you are probably not expecting:

  • He can create a symlink to /:

    cd /home
    ln -s / evil-symlink

    Now he can access the contents of the root filesystem as /home/evil-symlink/ as root, because it's located inside /home.

  • He can create setuid executables inside /home. Just copy /bin/bash to /home/bash, do chmod u+s /home/bash and you have your own root shell.

They only way to limit a user to a certain directory regardless of permissions that I can come up with is chroot, and it's common knowledge that root can break out of a chroot.


First, what you did wrong:

user1, %operator ALL= /home/users

This allows user1 to run any command in the directory /home/users as any user. If there is no executable program in that directory, the rule effectively does nothing. If there are executable programs there, the rule allows user1 to run them.

You cannot use sudo to give users permission to access file, only permission to execute a command as another user.

See Allow a user to read some other users' home directories for a way to do what you're trying to do.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .