sudo rules

[Robert Legatie]

I am trying to setup sudo rules for the following conditions:
1) Any user in the "test" group can delete any files created by anyone in the "temp" group. I am not sure if a sudo rule is needed for this or some permissions need to be setup.

2) Users in "test" group can kill or put to sleep any process ran by anyone in the "temp" group.

This is what I have so far:
Host_Alias TEST_BOXES=abcd1234

User_Alias TEST_USERS=

Cmnd_Alias TEST_CMNDS=/usr/bin/kill,\
/usr/bin/sleep


# Rules
TEST_USERS TEST_BOXES = (test) NOPASSWD: TEST_CMNDS


Any help will be appreciated.
Thanks in advance.

[Mel Burslan]

I think you have a misunderstanding of how sudo works. In the sudoers snippet you gave in your original post, the TEST_USERS group of users (I am not sure who these are as the User_Alias is set to null but it might be defined elsewhere so I am not hung on that) are able to run kill and sleep commands (unless you replaced them with some custom scripts, but you should not do that as you know very well) as root user, ending up being able to kill any process on the system.

sudo itself does not discriminate about the ownership or permission of any files. The commands allowed by any directive in /etc/sudoers file, run as root user. Period. So giving access to kill command to someone who is not an experienced sysadmin, via sudo is an open invitation to diseaster.

The functionality you are after, i.e., allowing rights to a certain group members to be able to delete files created by another group member, requires a finely crafted script in my opinion, which is allowed to run via sudo (which is a whole new can of worms, running scripts instead of executables via sudo that is)