topic Re: Sudo set up question in Operating System - HP-UX

Sudo set up question

Eric Kaiser — Tue, 07 Nov 2000 19:50:55 GMT

--------------------------------------------------------------------------------
I am trying to set up sudo to allow some users to only have rm capabilties in /var/spool/lp/request directory, and every printer under-neath. Sam or restricted sam only allows you to select 1 request at a time. I like the way sudo runs so far but this would GREATLY help out. I already tried tweaking the sudoer file with the following line but it doesnt work. I would imagine I am close but no cigar as of yet.
OPS PROD=PASSWD:/usr/bin/rm /var/spool/lp/request/

Thanks in advance...

Re: Sudo set up question

Alan Riggs — Tue, 07 Nov 2000 20:13:28 GMT

I know of no way to configure sudo to allow access ot a command only if the flag passed to the command meets a certain criteria (in the desired directory, in your case).

You might want to simply write a wrapper that colects any number of arguments, checks to make sure no paths are absolute, then does a cd to the directory and passes the argument to rm. Give sudo permissions ot that wrapper, and you are done.

Re: Sudo set up question

Rick Garland — Tue, 07 Nov 2000 20:21:39 GMT

Pretty much ditto, sudo will allow you to execute certain commands as root but the excution of the command will not follow additional conditions, in this situation, the rm of files in a certain directory. As root, you can do the rm command anywhere you want.

You can setup a script (wrapper) that only sudo (root) can execute and in that script it will remove the specified files.

Re: Sudo set up question

Jordan Bean — Tue, 07 Nov 2000 22:19:56 GMT

I would give them sudo access to

/usr/bin/{cancel,enable,disable}, and
/usr/sbin/{accept,reject}

rather than /usr/bin/rm.