Hello, I would like to know what should I put on the sudoers file to block a determined group os using just one specific command as root?
Thank you very much.
RTM
January 17, 2008, 10:15am
2
By using the ! and the program you don't want to run...BUT,
It is generally not effective to ``subtract'' commands from ALL using the '!' operator. A user can trivially circumvent this by copying the desired command to a different name and then executing that. For example:
bill ALL = ALL, !SU, !SHELLS
Doesn't really prevent bill from running the commands listed in SU or SHELLS since he can simply copy those commands to a different name, or use a shell escape from an editor or other program. Therefore, these kind of restrictions should be considered advisory at best (and reinforced by policy).
Suggest you look at the options available and do it a different way.sudoers manual