Sudo is a mechanism that enables a system administrator to give regular users permission to execute certain commands that they would normally not be allowed to use. Which user can do what is defined by the contents of /etc/sudoers. Typically you should use visudo to edit this file. So how do you prevent a user from using sudo to run specific commands in a subdirectory like /usr/bin but allow the user to run other commands in that same directory? Here is one way of doing it: # list of commands alice may not run Cmnd_Alias BANNED = /usr/bin/su, /usr/bin/ksh, usr/bin/zsh
