mjhjmtu

I want to keep a log-file on my computer. I also want to give privileges to a different account to do all sorts of system specific jobs such as mount volume/install packages etc. So that user has to have root privileges but must be restricted from a single log file such that s/he should not be able to change/delete/write that specific file.

First, you can make the log file unwritable by the root via the sudoers file:

user ALL=(ALL) !/var/log/logfile

That will make it so that the logfile can't be modified, moved, or deleted by the root.

Then you can edit the sudoers file so that the user can only use the commands which you've decided are necessary:

user ALL=(ALL) /bin/command1 /bin/command2 /bin/command3

user ALL=(ALL) !ALL

That will disallow any commands that you don't want the user to have. You can also make the sudoers file immutable via chattr +i /etc/sudoers so that the user can't modify it as root to allow himself to access the log file.

If you can't limit the sudo for the user, then you can sync logs to different node (rsync/rsyslog).

A user that is given superuser permissions on a system needs to be

1. Fully trusted, and


2. Accountable.

If that's not the case, then the operations that the user needs to undertake as root should be narrowly specified in such a way that they may be listed in the sudoers file in a precise manner (e.g. only be able to run rm on these files). Such a user should also not be able to use sudo to gain a root shell environment.

If this is not possible, then consider setting up a separate non-root account under which all needed operations may be performed.

Yes you can restrict a sudo user to restrict to run some specific root user commands. so that he/she can execute the configured permission as shown below.

Example : You can give the required permissions in vi /etc/sudoers
or type visudo

Add below types of required permissions in /etc/sudoers file.

User_A_permissions:

Cmnd_Alias PERMISSIONS = /usr/sbin/lsof, /usr/bin/ssh, /usr/bin/scp, /usr/bin/rsync, /usr/bin/telnet, /usr/bin/traceroute, /usr/bin/kill, /usr/bin/ps, /usr/bin/netstat, /usr/bin/grep, /usr/bin/crontab, /usr/sbin/tcpdump, /bin/ping, /usr/bin/crontab -u root -l, /usr/bin/crontab -u root -e, /etc/init.d/crond reload, /usr/bin/updatedb, /bin/df, /usr/bin/du, /usr/bin/locate, /usr/bin/find, /bin/su

After that add below line

%User_A_permissions ALL=PERMISSIONS