Best approach for allowing a standard user perform system-wide operations without adding them to the `sudo` group.

[kaybangz]

Linux newbie here I would like to know if it's possible for a standard user to perform system-wide tasks like creating and deleting a user, or installing software, without being in the sudo group.

I stumbled upon the approach of edit the sudoers file using visudo and specifying commands for the user, but I would like to know if there are other better approaches.

Thanks in advance for engaging.

 

[dos2unix]

short answer - not really.

At least not feasibly. However you can limit what commands someone in the sudoers file can do.
Even which programs they can install and uninstall.

Sudo is the standard for running root admin commands.

 

[f33dm3bits]

Sudo is the standard for running root admin commands.

You can use run0 now too, but I haven't tried it yet.

systemd Rolling Out "run0" As sudo Alternative - Phoronix

www.phoronix.com

 

[kaybangz]

short answer - not really.

At least not feasibly. However you can limit what commands someone in the sudoers file can do.
Even which programs they can install and uninstall.

Sudo is the standard for running root admin commands.

Ooh! I thought as much. Thanks

 

[kaybangz]

short answer - not really.

At least not feasibly. However you can limit what commands someone in the sudoers file can do.
Even which programs they can install and uninstall.

Sudo is the standard for running root admin commands.

Ooh! I thought as much. Thanks

You can use run0 now too, but I haven't tried it yet.

systemd Rolling Out "run0" As sudo Alternative - Phoronix

www.phoronix.com

I'll definitely check it out. Thanks.

 

[kc1di]

Hello @kaybangz
Welcome to Linux.org forum, enjoy!
What you saying would not be easy though it could be done but changing the permissions on the files you what them to be able to use. But in my opinion that would open up the system to a worse situation that just allowing them sudo or run0 priviledges.

 

[kaybangz]

Hello @kaybangz
Welcome to Linux.org forum, enjoy!
What you saying would not be easy though it could be done but changing the permissions on the files you what them to be able to use. But in my opinion that would open up the system to a worse situation that just allowing them sudo or run0 priviledges.

Thank you
Are you referring to Linux capabilities? I think I stumbled upon that too, and you're right about how that would open up the system to a worse situation.

 

[kc1di]

No, Linux is very capable, but opening up each file/program/directory would be tedious at best. And it would render the built in security measures ineffective.

 

[Trenix25]

This is exactly why a normal user is used to do normal things, so they don't have such system wide powers. A normal user is not root and root is not a normal user. It is a really bad idea to give a normal user root powers. sudo exists to help to limit that sort of thing. You could try /usr/bin/su to become root, do your business, and then exit that subshell to become the normal user again.

Signed,

Matthew Campbell

 

[Trenix25]

Thank you
Are you referring to Linux capabilities? I think I stumbled upon that too, and you're right about how that would open up the system to a worse situation.

Permissions and capabilities are basically two different things in Linux, although Android uses the terms somewhat interchangeably. Your basic permissions in Linux are read, write, and execute, which means search access when applied to a directory. Capabilities in Linux are security specific bits that are all 1s for root and all 0s for everyone else. See man capabilities(7). Linux also allows for ACLs which is an Access Control List. This allows setting specific permissions for a specific user or group. See man setfacl(1). You must enable ACLs when you mount your Linux file system though in order to use them. ext4 does allow the use of ACLs, but I don't know if any of the other file system types do.

The idea of using capabilities is to "harden" a program by giving it only what it needs to do its job, rather than running it as root with setuid. This is known as the principle of least privilege.

Personally I think sysadmin stuff should be left to root, but some users may benefit from some very limited capabilities. My ftp and web servers both use cap_net_bind_service so they can bind(2) to the correct port number without having to run as root. My ftp server also uses cap_sys_chroot so it can use chroot(2) to limit access to the correct directory space. The ftp server only allows anonymous ftp logins.

Please let me know if you want more information about these topics.

Signed,

Matthew Campbell

 

[kaybangz]

Permissions and capabilities are basically two different things in Linux, although Android uses the terms somewhat interchangeably. Your basic permissions in Linux are read, write, and execute, which means search access when applied to a directory. Capabilities in Linux are security specific bits that are all 1s for root and all 0s for everyone else. See man capabilities(7). Linux also allows for ACLs which is an Access Control List. This allows setting specific permissions for a specific user or group. See man setfacl(1). You must enable ACLs when you mount your Linux file system though in order to use them. ext4 does allow the use of ACLs, but I don't know if any of the other file system types do.

The idea of using capabilities is to "harden" a program by giving it only what it needs to do its job, rather than running it as root with setuid. This is known as the principle of least privilege.

Personally I think sysadmin stuff should be left to root, but some users may benefit from some very limited capabilities. My ftp and web servers both use cap_net_bind_service so they can bind(2) to the correct port number without having to run as root. My ftp server also uses cap_sys_chroot so it can use chroot(2) to limit access to the correct directory space. The ftp server only allows anonymous ftp logins.

Please let me know if you want more information about these topics.

Signed,

Matthew Campbell

Permissions and capabilities are basically two different things in Linux, although Android uses the terms somewhat interchangeably. Your basic permissions in Linux are read, write, and execute, which means search access when applied to a directory. Capabilities in Linux are security specific bits that are all 1s for root and all 0s for everyone else. See man capabilities(7). Linux also allows for ACLs which is an Access Control List. This allows setting specific permissions for a specific user or group. See man setfacl(1). You must enable ACLs when you mount your Linux file system though in order to use them. ext4 does allow the use of ACLs, but I don't know if any of the other file system types do.

The idea of using capabilities is to "harden" a program by giving it only what it needs to do its job, rather than running it as root with setuid. This is known as the principle of least privilege.

Personally I think sysadmin stuff should be left to root, but some users may benefit from some very limited capabilities. My ftp and web servers both use cap_net_bind_service so they can bind(2) to the correct port number without having to run as root. My ftp server also uses cap_sys_chroot so it can use chroot(2) to limit access to the correct directory space. The ftp server only allows anonymous ftp logins.

Please let me know if you want more information about these topics.

Signed,

Matthew Campbell

This is very helpful. I'll take a look into how to enable ACLs when I mount the file system, and if I have any further questions, I won't hesitate to reach out.