I know how to restrict standard users to run a command by removing execute permissions for that command. But it's possible restrict standard users to run a command with a specific option/argument?For example a standard user should be able to run the following command:lsbut not:ls -lI think that this can be possible since there are some commands like chsh or passwd which a standard user can run them, but he get permission denied when he runs chsh root or passwd -a -S.
Restrict standard users to run a command with a specific argument
security;sudo;options;account restrictions
I think the only way would be to write your own wrapper to the command/utility in question and have it decide what is allowed or not allowed based on the (E)UID of the user who started it. The tools you mention that do this such as chsh or passwd have this functionality built into their implementation.How to write a wrapper for ls#!/usr/bin/perluse strict;use warnings;my $problematic_uid = 1000; # For examplemy $is_problematic = $< == $problematic_uid;unless(/ -l / ~~ @ARGV or $is_problematic){    exec qq{/new/path/to/ls }.join '',@ARGV}else{    die Sorry, you are not allowed to use the -l option to ls\n}You need to ensure that the path to the original ls isn't in your user's PATH. Which is why I wrote /new/path/to/ls. The problem is, this wrapper requires that your user be able to execute the original ls so the user may still circumvent it by calling the original ls directly.