Sudo set up question

[Eric Kaiser]

--------------------------------------------------------------------------------
I am trying to set up sudo to allow some users to only have rm capabilties in /var/spool/lp/request directory, and every printer under-neath. Sam or restricted sam only allows you to select 1 request at a time. I like the way sudo runs so far but this would GREATLY help out. I already tried tweaking the sudoer file with the following line but it doesnt work. I would imagine I am close but no cigar as of yet.
OPS PROD=PASSWD:/usr/bin/rm /var/spool/lp/request/

Thanks in advance...

[Alan Riggs]

I know of no way to configure sudo to allow access ot a command only if the flag passed to the command meets a certain criteria (in the desired directory, in your case).

You might want to simply write a wrapper that colects any number of arguments, checks to make sure no paths are absolute, then does a cd to the directory and passes the argument to rm. Give sudo permissions ot that wrapper, and you are done.

[Rick Garland · Accepted solution]

Pretty much ditto, sudo will allow you to execute certain commands as root but the excution of the command will not follow additional conditions, in this situation, the rm of files in a certain directory. As root, you can do the rm command anywhere you want.

You can setup a script (wrapper) that only sudo (root) can execute and in that script it will remove the specified files.

[Jordan Bean]

I would give them sudo access to

/usr/bin/{cancel,enable,disable}, and
/usr/sbin/{accept,reject}

rather than /usr/bin/rm.