Home / server / Questions / 1065729
In Process
secavfr
Asked: 2021-06-05 08:44:38 +0800 CST

Allow my users to remove root-owned directories within their HOME

  • 772

My users are on Ubuntu running Docker and mounting directories in their sessions. The problem is that any non-existing directory or file mounted with Docker is owned by root.

I would like to allow my users to remove any root-owned file or directory under their $HOME directory with an /etc/sudoers directive. Something like :

# /!\ This is not working
%MyUsers ALL=NOPASSWD: /bin/rm $HOME/*
  • Is it possible within /etc/sudoers ?
  • What options do I have ?

Thanks for your help.

Using Docker-rootless mode is not an option for us.

linux ubuntu sudo

1 Answers

  1. If they're running docker as root, and they can control the daemon, they're already root.

    Trying to grant them limited sudo permissions is pointless and you're better off granting them full root access to their machines.

    In addition to which, it is nearly impossible without a wrapper to grant them permission to execute rm $HOME/* as root securely. I'd just have to ln -s / $HOME/root and I could delete anything.

    • 2