| 1 |
On Thu, 22 Dec 2011 13:53:43 -0500 |
| 2 |
Tanstaafl <tanstaafl@×××××××××××.org> wrote: |
| 3 |
|
| 4 |
> On 2011-12-22 1:00 PM, Nikos Chantziaras <realnc@×××××.de> wrote: |
| 5 |
> > On 12/22/2011 05:44 PM, Tanstaafl wrote: |
| 6 |
> >> On 2011-12-20 12:19 PM, Nikos Chantziaras <realnc@×××××.de> wrote: |
| 7 |
> >>> If you allow someone to edit root owned files, you're practically |
| 8 |
> >>> giving him root access. |
| 9 |
> >> |
| 10 |
> >> Well, yeah, but only on those defined files... |
| 11 |
> > |
| 12 |
> > root access is global. You can't limit it. root is root, the all |
| 13 |
> > powerful Unix being. Period :-) |
| 14 |
> |
| 15 |
> Ummm... then what is the purpose of sudo?? |
| 16 |
|
| 17 |
The purpose of sudo is to provide *fine-grained* control of elevated |
| 18 |
privilege to users and groups. Few people seem to realize just how |
| 19 |
finely this can be controlled, most assume that sudo lets you become |
| 20 |
root and that's it. |
| 21 |
|
| 22 |
As with all things fine-grained, it can get very complex very quick. If |
| 23 |
you want to allow 5 commands to operate on 5 files, you have to make 25 |
| 24 |
allow statements (unless you can use some funky wildcard syntax). |
| 25 |
|
| 26 |
|
| 27 |
> |
| 28 |
> If I add the following line to sudoers: |
| 29 |
> |
| 30 |
> %sudoroot |
| 31 |
> ALL=(root)NOPASSWD:/bin/chmod /var/www/localhost/htdocs/* |
| 32 |
> |
| 33 |
> Are you saying that this does NOT limit anyone in the sudoroot group |
| 34 |
> to *only* be able to run the chmod command, and only on files located |
| 35 |
> in /var/www/localhost/htdocs? |
| 36 |
|
| 37 |
Not quite, take out the word "only". When you say only, you exclude |
| 38 |
everything else and that is not true - you might have a second set of |
| 39 |
permissions somewhere else. The line you quoted does exactly what |
| 40 |
you said without the word "only" - it allows the action. Different |
| 41 |
commands and different files are outside the scope of that config line |
| 42 |
|
| 43 |
> |
| 44 |
> > Then you put the files in a special group and make them g+w, and |
| 45 |
> > add the affected users to that group. Then they will able to write |
| 46 |
> > to those files. If you want to give them write access to a whole |
| 47 |
> > directory, you put the directory in the group and make it g+w. This |
| 48 |
> > is how it's traditionally been done in Unix for ages, and it's |
| 49 |
> > extremely easy to set up. |
| 50 |
> |
| 51 |
> Yeah, I think I got a little tunnel vision trying to do this with |
| 52 |
> sudo. |
| 53 |
|
| 54 |
Permissions and right of access is hard. Few people know how to do it |
| 55 |
right, and you can't consider just sudo in isolation. |
| 56 |
|
| 57 |
sudo is one command in a whole system and you have to take that into |
| 58 |
account too. The method you use will depend more on everything else |
| 59 |
that machine can do than just on what sudo you can do. |
| 60 |
|
| 61 |
If you need to allow just one single user to access just one single |
| 62 |
directory, you are better off with using Posix ACLS (NOT regular |
| 63 |
owner, group and perms - that almost never works out right for www data) |
| 64 |
|
| 65 |
If you have many different users needing all sorts of different access |
| 66 |
to things, you might even consider SE-Linux. Just be prepared for huge |
| 67 |
amounts of customizing. But if it really is what you need, SE Linux is |
| 68 |
worth the sweat. |
| 69 |
|
| 70 |
|
| 71 |
-- |
| 72 |
Alan McKinnnon |
| 73 |
alan.mckinnon@×××××.com |
Archives