My sudo policy let (power: staff
) users do some system tasks like
apt install software from known repositories, dynamically mount shared volumes (with hidden root-only credentials) or control system processes and logs
in /etc/sudoers.d, a local policy file could be:
%wheel ALL = (ALL) NOPASSWD: ALL
%staff ALL = (root) NOPASSWD: /usr/bin/apt
%users ALL = (root) NOPASSWD: /bin/mount
%users ALL = (root) NOPASSWD: /bin/umount
%users ALL = (root) NOPASSWD: /bin/systemctl
%users ALL = (root) NOPASSWD: /bin/journalctl
# %users ALL = (root) NOPASSWD: /sbin/shutdown
while is denied to assume other identities or add unknown PPA repos (apt-add-*),
unless (admin) user member of the wheel
group.
You could "fine" tune privileged access via a custom command interface provided by a sudo-enabled script.
Internally the script can escalate permission, by self invoking via sudo:
#!/bin/sh
if [ ! "$1" = '--sudo' ]; then
exec sudo $0 --sudo $@
fi
##
# privileded part
#
...
UBUNTU user note
everything is useless, unless you change default permission on home directories (cfr. RHEL/Fedora)
chmod 750 $HOME