The /etc/hosts needs to be readable by other program in order to fulfill its purpose. If you encrypt the file in any way, those other programs will not be able to read the file - and it will stop working.
So in short, you cannot do this (i.e. encryption) in a meaningful manner.
However what you can do is ensure that others do not have passwords for administrative accounts on your Mac. If they do need more privileges for something, make it so that you assign access to that specific resource (for example via a sudo access limited to a specific program) - and ensure that you do not give out full administrative access.
An example of using sudo for giving access to edit a file is to use the "sudoedit" option in sudo. This allows you to give another person access to edit a file without letting their editor run as the privileged user (which is bound to let them "escape" and allow them to other things as the privileged user). It is achieved by copying the privileged file into a separate location, letting the user run their usual editor under their own user id to edit that file, and then copying its contents over the privileged file afterwards.
In sudoers you would specificy something like:
username sudoedit /etc/hosts
By default this will allow "username" to edit that file, and requires him to enter his own login password before doing so.
If you want to the user to input a different password, that is not his login password, you have basically two ways of going about it.
One way is not to use "sudoedit": Instead create a custom program (can be a shell script) that simply inputs a string and checks that it matches the password you want, and then just mimics what sudoedit does. It can also be quite simple and just a "cp" command to copy over a specific path from the user's own home folder to /etc/hosts.
The alternative is to modify which passwords sudo will accept as valid. This is done by editing /etc/pam.d/sudo and uncommenting the standard lines beginning with "auth". Instead provide the authentication module and options you want to approve.
If you want to do something completely custom, you can compile your own PAM module that simply asks for a password and checks that it is a specific string. You can start with the source code for the default pam_opendirectory PAM module and simply rip out the OpenDirectory parts and replace it with a simple strcmp(). The source code for such a custom module is very few lines of code.
You can find the pam_opendirectory PAM module source code here:
https://opensource.apple.com/source/pam_modules/pam_modules-76/pam_opendirectory/pam_opendirectory.c.auto.html
/etc/sudoers
so it will blocksudo vim
and users would instead need to do asudo -u hosteditor vim ...
with a different password. Seeman sudoers
. – bdecaf May 30 '19 at 9:04sudoers
file. applegazette.com/mac/… points out that you must use a special editor,visudo
, but I'm not sure if that is still the case. It used to be, and you could wreck yoursudoers
file if you just use nano or vim or whatever. – FiddleDeDee May 30 '19 at 15:20EDITOR
orVISUAL
to your preferred editor. This will then be used. Btw. this also works withsudo -e
which is more comfortable as it will also use the users editor setup (and not roots). – bdecaf May 31 '19 at 2:11