Question

5

Will this sudo rule allow a user to update the system and nothing more?

rated 0 times [ 5] [ 0] / answers: 1 / hits: 1705 / 1 Year ago, wed, november 30, 2022, 9:53:48

I want to design a sudo rule that will allow the user ricardo to update the system using aptitude, but prevent him from using sudo to run any other command (he's a problem user). Are there any pitfalls to this rule that I'm missing?

ricardo  ALL=(root) /usr/bin/aptitude

Ricardo only uses aptitude, not apt-get. Also, I don't have Ubuntu installed anywhere at the moment, so I understand that /usr/bin/aptitude might not be the exact right file to allow.

If there are pitfalls to this rule, how can I improve it?

Answers

Only authorized users can answer the question. Please sign in first, or register a free account.

ciousuntru

Add To Favorites

Follow

Total Points: 352

Total Questions: 124

Total Answers: 95

Location: Grenada

Member since Tue, Oct 12, 2021

3 Years ago

answered 1 Year ago rmiend · Accepted Answer

This command will restrict the user from using aptitude for anything but updating the repository cache and performing a safe upgrade of the system.

ricardo ALL=(root) /usr/bin/aptitude update, /usr/bin/aptitude safe-upgrade

A similar command will allow the user to perform a full upgrade, but nothing more:

ricardo ALL=(root) /usr/bin/aptitude update, /usr/bin/aptitude full-upgrade

Per aptitude's documentation (10.04), safe-upgrade:

Upgrades installed packages to their most recent version. Installed
packages will not be removed unless they are unused

In contrast, full-upgrade:

Upgrades installed packages to their most recent version, removing
or installing packages as necessary. This command is less
conservative than safe-upgrade and thus more likely to perform
unwanted actions. However, it is capable of upgrading packages that
safe-upgrade cannot upgrade.

Use your best judgement for which the user should be allowed to run. If you're unsure, use the first rule, which only allows safe-upgrade.

Note that if you want to allow a user to install packages (which greatly reduces any benefit to security, but hypothetically), you need to include a * after the aptitude command, i.e.

ricardo ALL=(root) /usr/bin/aptitude update, /usr/bin/aptitude safe-upgrade, /usr/bin/aptitude install *

Otherwise, you will receive an error message that user ricardo is not allowed to run the command /usr/bin/aptitude install <package_name>.