3

I need to lend my MBP to a friend for a few days while their laptop is out for repair. I would like to not have to erase my account to do that.

I have set up another User Account for them without Administrator Privileges.

They need to use my laptop for development and will probably require sudo access at some point.


Is there a way for me to allow them sudo access but not allow them access to any data stored for my own user.

Anecdotally, this does not sound possible, because sudo access would mean the highest access on the machine so everything will be accessible.

Is there any other way to achieve this without having to erase my data?

I found this question that is looking for ways to encrypt each user folder separately but without answers.

  • 3
    Assuming the internal drive is not encrypted and one has physical access to your computer, all one needs to do to access your data is to boot the computer to the Recovery HD or from a Linux Live OS USB Drive, even a macOS USB Installer, and they have access to your data regardless of how you edit the sudoers file!!! – user3439894 May 18 at 11:41
  • Regardless of any merit the (current) accepted answer might have, and it does have some but IMO not really in this case, because once you physically hand your computer over, there are a number of vectors your data can be easily accessed and copied off the computer and done right, you'll have no way of knowing it was even done! Cont'd... – user3439894 May 19 at 19:33
  • Cont'd.., The simplest of which is to boot to the Recovery HD where it can be simply and easily copied to a USB drive formatted as FAT32 where effectively the permissions are no longer observed. The e.g. Macintosh HD can be unmounted and remounted read-only and thus there will be no access time modifications to assuage any doubt that curiosity didn't get the best of your friend. FWIW I have never and will never hand over to anyone any computer that has my data on it! Never have to worry or give it a second though in doing so! – user3439894 May 19 at 19:33
  • Thank you for the insight @user3439894. I understand that physically handing over a computer to someone without an encrypted disk means all my data is just waiting for the user to exploit. And for a scenario of that sort, I would agree that there is no solution but to delete or encrypt all data. But given the current scenario, I know the person as a friend and there is a factor of trust baked into the exchange. I am not assuming any intent on his part to misbehave. I just want to not make this very easy if the thought strikes him at all. – Sinstein May 20 at 10:55
  • The accepted answer will not work for all scenarios, but in this situation, that was the extent of my question. – Sinstein May 20 at 10:56
6

The Answer:

Yes, it's definitely possible. sudo is designed to implement fine-grained security policies. As an example of fine-grained, sudo can be configured to allow a user to run a particular command, but exclude certain options for the command. Don't get sudo confused with su.

And so, when you say, "sudo access would mean the highest access on the machine so everything will be accessible", that's simply not true. IMHO, sudo was made to order for the exact problem you are faced with: "How do I give a user access to resources he needs to do his job, without giving him the run of the castle?" You may also appreciate the fact that sudo performs extensive logging of all sudo usage. This provides accountability for all sudo users because, unlike su, users execute sudo from their account, not the root account.

Here are two examples to illustrate this point. These are two entries that would go in the sudoers file - the file that defines a user's privileges under sudo. In the first example, the user friend will be given "access to everything"; i.e. unlimited root privileges:

Example: sudo for Full root Privileges

friend   ALL = (ALL) ALL  

In the next example, the user friend will only be given privileges to run the software update option (-U) on the utility youtube-dl. This specification will confer root privileges to run only this one command with this one option (although in this case most of the other options do not require root privileges.):

Example: sudo for Limited root Privileges

friend   ALL = (ALL) /usr/local/bin/youtube-dl -U

A Brief Overview of sudo:

I can't explain sudo in the space of this answer. As you'll see that simply is not possible. Instead, I'll try to provide provide a "walking tour" with some references that will give you a better understanding of what sudo can (and can't) do, and how to configure sudo to implement the security policy you want.

  • Todd Miller currently maintains sudo as he has since 1994. That probably makes him the godfather of sudo.

  • There is a prodigious amount of documentation on sudo, including many older versions - including ver. 1.8.17p1 used in the current version of macos (Mojave, 10.14.5).

  • Perhaps a good place to begin learning about sudo is in a nutshell

  • Having read this nutshell overview, you now know that sudo is typically configured using the sudoers file. This is where you will create the specifications that implement your security policy; the specifications that define what resources your friend can access while using your machine.

  • Again, there's a lot of documentation. You'll want to read man sudo (ver 1.8.17 online), and man sudoers (ver 1.8.17 online). OK, skim through it at least, and study the EXAMPLES :) And BTW, your friend will need to read man sudo also, as he'll be using it!

  • Once you've decided what resources your friend needs, you can prepare to tackle actually editing/creating your own sudoers file. But there are some things you should know first:

    1. The sudoers file should only be edited with visudo. To access it, you'll need to be logged in as (or su to) the "admin" user on your Mac. Upon entering the command shown below, the Sample sudoers file will be opened in your admin user's default editor (I've set mine to nano).

    2. Know that editing the sudoers file carries risks. Minimze those risks by NEVER editing sudoers except through the visudo app. visudo is designed to validate the syntax of the sudoers file when it is saved. That won't save you from errors that have the correct syntax of course, but it's far less likely that you'll leave your machine in an unusable state!

Making changes to the sudoers file:

And so: To edit the sudoers file, login as (or su to) the admin user, open a terminal window, and enter:

bash-3.2$ sudo visudo
Password:                # you'll need to enter your admin user's password here

The editor specified in your environment will open, and the sudoers file will be listed. The User specifications section is near the end of the file; you can insert one of the example lines from above, taking care not to edit either of the existing lines:

root ALL = (ALL) ALL
%admin ALL = (ALL) ALL
# insert your additions below here; e.g.:
friend ALL = (ALL) /usr/local/bin/youtube-dl -U

When you finish your edits, write the modified file, then exit the editor. visudo will automatically check the syntax of your sudoers file, and alert you if it finds a problem. You should never override these alerts; find and fix the issue, or simply comment out your changes until you do.

Using sudoedit to limit access to files

One final example: You wanted to grant sudo access, but not allow access to any data stored for your user. For purposes of this example I'll assume that you want to give your friend the ability to edit the file /etc/fstab.hd (a do-nothing file), and all files in the directory /etc/ssh.

You can use the sudoedit specification in the sudoers file to grant your friend access to files or entire directories that you specify. Here's how to accomplish that:

  1. Run sudo visudo to open the sudoers file for editing.

  2. As previously, enter the following sudoedit lines just below those you added previously; i.e.

root ALL = (ALL) ALL
%admin ALL = (ALL) ALL
# insert your additions below here; e.g.:
friend ALL = (ALL) /usr/local/bin/youtube-dl -U
# insert sudoedit specs below here:
friend ALL = (root) sudoedit /etc/ssh/*
friend ALL = (root) sudoedit /etc/fstab.hd

To edit these files, your friend will enter the following command(s) in a terminal window:

MyMacBook:~ friend$ sudo -e /etc/fstab.hd  

# or...

MyMacBook:~ friend$ sudo -e /etc/ssh/ssh_config

# which will open the specified file in `friend's` specified editor

Limits of sudo

You should also keep in mind that sudo has its limits.

First and foremost, sudo is used to get root privileges for a user from the command line (Terminal). It has no role in determining privileges anywhere else in the system; e.g. to add a new user in System Preferences. Outside the shell then, the authorization database controls access privileges, and sudo has no relevance. You may need a tool like this to manipulate the authorization database.

Secondly, sudo should NOT be considered as a tool to harden the system against malicious users. Rather, it's simply a tool for reducing risk and increasing accountability for authorized users. That's not to say it "rolls over", it's only to say that its purpose is not system hardening.

This seems like a good point to stop, and catch our breath :) Your question did not include any specific security goals or policies, so it doesn't seem to make sense to prattle on with more examples (and there are plenty of those available for the cost of a Google search). However, if you do want help with specific configurations, you can either edit your question here, or post a new question. And don't forget that as sudo is available on virtually all *nix platforms, there are other SE sites that may prove useful: SuperUser SE and Unix&Linux SE are two examples.


Other potentially useful resources related to sudo:

  1. AppleGazette on editing the sudoers file
  2. AP Lawrence on Using sudo
  3. Using sudoedit to limit file editing to a specific directory/ies
  4. More on sudoedit (aka sudo -e, aka sudo --edit)
  5. What's So Great About sudoedit?
  6. Good general (not Mac-specific) help from from Digital Ocean
  7. The sudo command, Part 2 of a 4-part series on "Demystifying root"
  • 1
    @nohillside: It's not necessary to know all of the commands beforehand; the commands can be enabled by location rather than individually (e.g. /usr/bin). And the issue with spawning a new shell has (I think) been addressed with the NOEXEC option that was introduced some time ago. For example: username ALL = NOEXEC: /usr/bin/less; ref. sudo is not perfect; but it's certainly a lot more capable than giving "blanket" root priviliges. – Seamus May 17 at 11:57
  • 1
    Assuming the internal drive is not encrypted and one has physical access to your computer, all one needs to do to access your data is to boot the computer to the Recovery HD or from a Linux Live OS USB Drive, even a macOS USB Installer, and they have access to your data regardless of how you edit the sudoers file!!! – user3439894 May 18 at 11:40
  • 1
    I am not talking about any typos there may be in your answer. The bottom line is the OP is worried about his friend accessing his data and as such, with the assumption that nothing is encrypted, it is absolutely totally irrelevant how one edits the sudoers file because once the computer is physically handed over his data can be accessed! – user3439894 May 18 at 12:11
  • 1
    @Seamus that is a totally different question - that one asks if the other party can be trusted. This question is that the other party cannot be trusted and so how do you block their access to the data and the answer is that as they have physical access to the hardware you cannot. Your explanation of sudo is very good but implementing your plan will not stop the friend from accessing the owner's data. – Mark May 18 at 13:18
  • 1
    The title asks for sudo but the question says ... but not allow them access to any data stored for my own user. So the question asks how to stop the friend reading data. (The OP has done a bit of looking and thinks that sudo might be the answer but that is a red herring)m If the friend can get access as we know - what does the sudo option add to security - just let him use the compute and ask him not to look at data is the same security, – Mark May 18 at 15:03
0

Once somebody has sudo rights they can access basically any non-encrypted files of other users easily. They can even copy encrypted files and use whatever tool they can get their hands on to crack the encryption. Also, with a lot of important stuff stored within ~/Library it might not be enough to just move Documents to an encrypted DMG.

So from the top of my head I see two options:

  • Log in as administrator and create an encrypted volume with the content of /Users/your-main-user, then remove the unencrypted folder content. Beside the caveat above it might be easier to just backup everything and delete the user
  • Set up remote access, ensure that you can run sudo if accessing through ssh and then have your friend ping you whenever they need to run sudo

PS: There might also be some (not totally safe) ways to restrict sudo to certain commands, but for this you need to know these commands upfront.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .