Sudo issues

[Herbert Wengatz]

Pradeep.Sadanapalli at med.ge.com wrote:

> Hi,
> I have got a problem as given below.
> 
> There is a user, say user1, to whom I want to give root access to the
> command 'rpm'.  At the sametime, say I want to block root access to a
> command, say 'passwd' for example.
> 
> so when a user tries to execute, "#sudo rpm -ivh xyz.rpm" , he can
> successfully execute this. But when a user tries to execute passwd as
> root
> "#sudo passwd root" , then the execution fails as the root access to the
> command 'passwd' is denied via sudo. Fine and good.
> 
> But if the user copies the command 'passwd' as command 'rpm' overwriting
> the existing 'rpm' command, say
> " #cp /usr/bin/passwd /bin/rpm"
> 
> then he can execute the passwd command as root.
> "#sudo rpm root" , then the command prompts for the change of root
> passwd and the user can successfully change the root passwd. 
> This is only an example , where I am using specifically two commands
> 'rpm' and 'passwd' .
> How can I avoid this?

If you let the rpm binary be only writeable for root and don't
give the user sudo permissions for "cp" or "mv" or some similar
dangerous command, everything should be fine.

But ask yourself, what will happen, if the user generates some rpm package
on behalf of his own interests. - Do you really want him to install that?

No "cp" necessary. You open the door via "rpm" widely.

You should ask yourself if you *really* want to do that...

HTH,

Herbert


-- 
Mit freundlichen Gruessen, / With kind regards,

Herbert Wengatz


Herbert Wengatz                        mailto:Herbert.Wengatz at Partner.BMW.de
CC CompuNet fuer BMW FZ-441            Hoerselbergstr. 7
Serverbetrieb Sun Solaris              D-81677 Muenchen
Unix is the only operating system, where 'more magic' really works.