[sudo-users] configuration question

[Meijer, Harm]

Hi All,

 

Our configuration needs to allow a group of Operators to be able to
execute some scripts in a certain directory, e.g. /usr/local/operators/

 

Within sudoers this is setup using an alias as shown below:

Cmnd_Alias SCRIPT = /usr/local/operators/*

 

The group of operators also has access to some other commands among them
is "tar". 

 

My question is how would we go about restricting the Operators from
extracting anything from a "tar" archive into the /usr/local/operators/
directory? As we don't want them to be able to introduce any new scripts
in the specific directory from which they're allowed to execute anything
in combination with "sudo".

 

With advanced appreciation,

 

Best regards,

 

Harm Meijer