Restrict sudo Users Running Specific Commands

Restrict sudo Users Running Specific Commands for Apple’s OS X, BSD and GNU Linux in various ways. This is a good way to increase security. It is not that, always we want to Restrict sudo Users Running Specific Commands for Not Relying, but mostly it is to prevent unknowing done errors which basically can destroy a system. If one changes the group ownership to Apache (www-data) with sudo command while at root, it will be impossible in most cases to revive the system.

Restrict sudo Users Running Specific Commands : Understanding the Difference of Philosophy in GNU Linux and UNIX

In UNIX, there is WHEEL GROUP. We talked about this UNIX Wheel Group in details in previously published article. Why we mentioned, re-enabling Wheel Group increases the control on users was explained. GNU Linux, by Philosophy do not like that way.

As we said there, by running visudo command, you can restrict by specific commands you want to restrict :

But if someone runs :

This is the basic reason we mentioned about Wheel Group, see Arch Linux Wiki :

Practically, the methods people mentions are for casual users; a serious user with definite target can manipulate the file permissions. There is another known method :

If we edit the /etc/sudoers.d file instead of modifying /etc/sudoers; If your user is called user and your host is called host you could add these lines to /etc/sudoers.d :

If password is protected to allow, obviously except the root none will able to run any commands except which commands are whitelisted.

Restrict sudo Users Running Specific Commands But Do Not Get Locked

In case, you are locked, you need to know about pkexec command :

You can check for Cmnd_Alias function :

But, sudo assumes we trust our users, that is GNU Philosophy :

Whenever you user can access to usernamed folder and you have some softwares like Java, Ruby, Python, PHP, Perl – any of them installed, it is basically possible to do many things. Wheel Group system actually makes the administration easier.