[sudo-users] Restrict chmod, chown and chgrp to certain directories

[Rigoberto Juarez]

Hi all,

I am trying to restrict the use of chmod, chown and chgrp to certain directory (Only such directory, no other should be enabled). I've been doing some test but it is not working properly.

Here are some approaches I have made with no luck:

1)
===============================================================
Cmnd_Alias DELEGATE =  /bin/chown /eda/*, /bin/chown /eda/* *, !/bin/chown /eda/*..*
Cmnd_Alias CHMOD = /bin/chmod /eda/*, /bin/chmod /eda/* *, !/bin/chmod /eda/*..*
Cmnd_Alias CHGRP = /bin/chgrp /eda/*, /bin/chgrp /eda/* *, !/bin/chgrp /eda/*..*

%eda ALL=(ALL,ALL)DELEGATE, EDAMOD,EDAGRP
===============================================================

2)
===============================================================
Cmnd_Alias      RUN_EXTENDED =\
                                /usr/bin/chgrp /eda/*,\
                                /usr/bin/chown /eda/*,\
                                /usr/bin/chmod /eda/*,\
                                /bin/chgrp /eda/*,\
                                /bin/chown /eda/*,\
                                /bin/chmod /eda/*


%eda ALL=(ALL,ALL)RUN_EXTENDED
===============================================================

3)
===============================================================
Cmnd_Alias EDAMOD =  /bin/chmod [0-7][0-7][0-7] /eda/*, /bin/chmod [0-7][0-7][0-7] /eda/* *, !/bin/chmod [0-7][0-7][0-7] /eda/*..*
Cmnd_Alias DELEGATE = /bin/chown -[RPfchv] [a-z]\:[a-z] /eda/*, /bin/chown -[RPfchv] [a-z]\:[a-z] /eda/* *, !/bin/chown -[RPfchv] [a-z]\:[a-z] /eda/*..*
Cmnd_Alias EDAGRP = /bin/chgrp -[RPfchv] [a-z]\:[a-z] /eda/*, /bin/chgrp -[RPfchv] [a-z]\:[a-z] /eda/* *, !/bin/chgrp -[RPfchv] [a-z]\:[a-z] /eda/*..*

%eda ALL=(ALL,ALL)DELEGATE, EDAMOD,EDAGRP
===============================================================

Do you any idea or example to accomplish this task?

Regards.