How to allow an admin to do everything except changing password of another admin : Ub

[solarinside]

Well, and just forbid the cp command on only one directory?

[Lars Noodén]

If cp is blocked then there would be tar and the others mentioned above.

tar cf - /bin/cp | (cd /tmp/; tar xf -);
sudo /tmp/bin/cp a b

I'm not sure if there are infinite combinations but it approaches infinity.

The one way that does work is to make a list of the allowed applications.