0

I would like to grant sudo privileges to a user but only on a specific path. For example:

user@domain $> sudo touch /etc/test/directory/samplefile

where that user doesn't have permissions to the /etc/test/directory path which doesn't belong to the user, and I don't want to open the permissions more, I don't want to make the user part of the directory's group because that would give the user permissions to other directories as well.

So far I've tried to add this in the /etc/sudoers file:

user ALL:/etc/test/directory/=(ALL) NOPASSWD: ALL

but that syntax is not right according to visudo.

any ideas on how to do this approach?

Improve this question
5
  • 3
    I don't think sudo is capable of this. You are likely going to need to think of a different approach for whatever you are trying to do. Commented Jun 21, 2019 at 17:10
  • "I don't want to make the user part of the directory's group because that would give the user permissions to other directories as well. " Create a new group specifically for this problem, change only this directory to be owned by this new group and add your user in the group. That can solve your problem without having to use sudo which is nice and powerful and hence can create problems just by itself. But otherwise I agree with Michael that you are not describing your core problem sufficiently as exposed as it is it is not a good fit for sudo. Commented Jun 21, 2019 at 17:58
  • @MichaelHampton what I'm trying to do is to create a script which is generating a file in a directory that is owned by a specific user, the script that is executing this, can't save the file there because it doesn't have the permissions to do that, I don't want to open the permissions more because it would be insecure, also the generated file has to have the permissions of onwership and group the same as the directory, so I don't see any other option. Commented Jun 21, 2019 at 19:23
  • @PatrickMevzek If you are interested as well, that above is what I'm trying to do. Thank you both for your responses. Commented Jun 21, 2019 at 19:24
  • 2
    Consider file system acl’s which can offer much more granular access rights than what can be achieved with only the conventional user-group-other model. Commented Jun 21, 2019 at 22:20

1 Answer 1

Reset to default
1

You can probably do this by using sudo to allow users (one/some/all) to run the script as a user that is a member of the group, etc. that has access rights to the directory.

This page - https://lifecs.likai.org/2016/02/generic-setuidsetgid-wrapper-for-scripts.html seems to tackle your problem quite well, the sudoers line suggested -

ALL ALL = (script-owner) NOPASSWD: /path/to/script

run with sudo -u script-owner /path/to/script

Improve this answer
1
  • I think there's a confusion, I want to be able to run "sudo" in a specific location no a script located in a specific location. Commented Jun 23, 2019 at 2:16

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.