I want to set user zamo to have read only access to the directory /var/log/autosys and the directory below that .

will my below settings in /etc/sudoers work ? Not to add the user to the directory group .I want to do that using sudo only .

You can change the permissions of subdirectories of /var/log (but not /var/log itself) without causing issues in future updates.

Given that you could just make /var/log/autosys readable by everyone (chmod 755) or you could put a different group on that directory and add zamo to that group.

If you don't want to muck with the group you could use ACLs instead to add just zamo.

I don't think sudo would be a good tool for this especially when you're talking about "reading" files. I've seen far too many admins give something silly like "sudo vi /var/log/autosys/*" to a user without understanding that the sudo is running the vi as root so simply typing ":!/bin/sh" in the sudo vi session puts the user into the shell as the root user. Once they've done that you might as well have just given them the root password as they just became root.

Why use sudo?

You can probably do this with ACLs

--C

1 members found this post helpful.

Thanks for the update and suggestions