sudo and allowing a user access to all but one command

[Marc Ahrendt]

cat /etc/sudoers
Host_Alias HOST1=riddler
User_Alias USER1=mahrendt
Cmnd_Alias COMMANDS1=ALL
root ALL=(ALL) ALL
USER1 HOST1=COMMANDS1

how can i modify the above to actaully allow mahrendt to sudo all commands except "shutdown" for example

i was thinking it would be something like the following

Cmnd_Alias COMMANDS0=/sbin/shutdown
USER1 HOST1=ALL, !COMMANDS0

i know a smart user could rename shutdown to run it or escape to a shell from an app to run it ...so i know this is not bullet proof but will help me out in my particular situation

[Sridhar Bhaskarla]

Hi Marc,

Did you try it?. If it is not working then try

Cmnd_Alias COMMANDS0=!/sbin/shutdown

and specify

USER1 HOST1=(ALL) ALL COMMANDS0


-Sri

[James A. Donovan]

Marc,

What you have already will work. Like you said it's not bulletproof....heck, it's not even really bullet resistant ;-)

[Marc Ahrendt]

just wanted to state that sudo worked as i had detailed above ...and greatful for the feedback