I want to design a sudo rule that will allow the user ricardo
to update the system using aptitude
, but prevent him from using sudo to run any other command (he's a problem user). Are there any pitfalls to this rule that I'm missing?
ricardo ALL=(root) /usr/bin/aptitude
Ricardo only uses aptitude
, not apt-get
. Also, I don't have Ubuntu installed anywhere at the moment, so I understand that /usr/bin/aptitude
might not be the exact right file to allow.
If there are pitfalls to this rule, how can I improve it?