Second root account

Question

i'm new in linux, so i'm sorry if my problem is a bit confusing.

I'd like to do following:

• create a second root account

• write the file by using this account

• the first root account shouldn't be able to edit this file (and no other accounts either).

Is it possible?

Answer 1

Effectively speaking, no you cannot do this. you can effect this using sudo, but ultimately if you have the power of uid=0, you can do anything you want.

Answer 2

What you actually want is to have two users with equal privileges. Neither of them is root.

Answer 3

The purpose of the root account is to be able to do everything. It must be use only the system administrator, and use only when necessary.

Every users (even administrator) should use a regular account.

So who the system Administrator? The one who will use the first account or the second?

It's not possible to create a second root account.

The concept of a root account, is to be unique and able to do everything

Answer 4

As previously stated, root is root. What you may want is an encrypted file(s). Here is a wrapper using Bcrypt

#!/bin/sh
[ "${1##*.}" == "bfe" ] && BASENAME=${1%.bfe} || BASENAME=${1}
BASENAME=${BASENAME##*/}
MD5=`echo "$USER:$BASENAME"|md5sum`
echo "${MD5:0:32}
${MD5:0:32}" |bcrypt "$1"

This one allows users to encrypt their own files, but only uses an md5sum of the user name and file's basename for the "salt".

If you wanted to get really paranoid you could use some pseudo-steganography with bcrypt's -o option and >> some-large.jpg (I wrote a partial example here: ... just as proof of concept)

Another way to do this would be to embed the file in a c program so that it only spits out the data if getenv(USER) matches your admin account name

of course none of this will permit root from moving,renaming,deleting... only from editing in a useful way

Answer 5

I believe what you're asking for is role based access control or RBAC. It's been a standard part of Windows and Solaris for quite some time. For the Linux world, you need to look at using SELinux. I think it's a bit too involved for a post here, but you should be able to find a tutorial by googling "SELinux RBAC"