A quick example on how to provide root permissions on specific commands to a specific group of users.
You can create command aliases, which can be very useful when formatting and controlling access to these.
For example:
Cmnd_Alias vi = /usr/bin/vim
This will match both /usr/bin/vim or just plain vim.
Assigning ROOT permissions to run this command alias to a specific user:
username ALL=(root) vi
And the same for a group:
%groupname ALL=(root) vi
In my example below, I provide access to use all the NGINX service commands on a redhat 6 system, to a new group called nginxadm.
Open up the sudoers file using visudo.
## NGINX USERS - should be part of nginxadm group
# Usage: nginx {start|stop|restart|condrestart|try-restart|force-reload|upgrade|reload|status|help|configtest}
Cmnd_Alias NG = /sbin/service nginx
Cmnd_Alias NGRES = /sbin/service nginx restart
Cmnd_Alias NGSTA = /sbin/service nginx start
Cmnd_Alias NGSTO = /sbin/service nginx stop
Cmnd_Alias NGSTS = /sbin/service nginx status
Cmnd_Alias NGCDR = /sbin/service nginx condrestart
Cmnd_Alias NGTRS = /sbin/service nginx try-restart
Cmnd_Alias NGFRL = /sbin/service nginx force-reload
Cmnd_Alias NGUPG = /sbin/service nginx upgrade
Cmnd_Alias NGRLD = /sbin/service nginx reload
Cmnd_Alias NGHLP = /sbin/service nginx help
Cmnd_Alias NGCFG = /sbin/service nginx configtest
%nginxadm ALL=(root) NG,NGRES,NGSTA,NGSTO,NGSTS,NGCDR,NGTRS,NGFRL,NGUPG,NGRLD,NGHLP,NGCFG
Thanks to FACLs in Linux, we can also give granular permissions to the NGINX configuration files.
