I want one administrator to be able to edit the /etc/fstab file but one administrator to not be able to edit the fstab file.Both administrators need access to all other administrative tasks.Is this possible?I am assuming I would need to somehow setup what files sudo gives them access to. Or possible just make non administrative accounts and then create a group called fstab-access and add one of the users to that and setup privileges for that group... ? Am I on the right track?
How to limit administrative privileges to various config files?
sudo;administration;privileges
If you only wanted to allow a user to edit /etc/fstab, you could do this in several ways:Make sure access control lists are enabled (acl option in the /etc/fstab entry for /), and setfacl -m user:joe:rw /etc/fstab.Add a sudoers rule: run visudo and add a line joe ALL = sudoedit /etc/fstabI recommend the sudo method because it makes it easy to audit who can do what.However, if you allow a user to edit /etc/fstab, then they can indirectly gain root by adding an entry that lets them mount an external or loop filesystem on which they've planted a setuid root binary.It is rather weird to allow a user to edit fstab only. If you want to allow users to mount removable devices, use pmount (or rely on desktop environments).If you allow a user to run non-whitelisted commands as root (all other administrative tasks), then you cannot prevent them from editing any particular file. At some point, you need to decide whether you trust these people or not. If you don't trust them to administrate your machine, don't give them privileges (make them use another machine, perhaps a virtual machine instead). If you do trust them, let them become root, and tell them that certain files are off-limits.