Réf. : the !

[steve.bernier at desjardins.com]

It's still true, because the user could:

sudo cp /usr/bin/ksh /tmp/newksh
sudo /tmp/newksh

or simply do

sudo vi /tmp/blabla

and inside vi do a «shell» command:

:! /bin/ksh

There is probably a billion way to do that.

There is no way around this, this kind of authorization is exactly like giving root (without the root password).

Steve Bernier





"Kaysee Long" <kaysee at us.ibm.com>@sudo.ws on 2002-02-05 14:48:28

Envoyé par :   sudo-users-admin at sudo.ws


Pour :    sudo-users at sudo.ws
cc :
Objet :   the !


Hi I am compiling the newest version of sudo and a security doc (outside of
sudo) said this:

Commands sshould not be subtracted from ALL using "!" because the user
could copy the command to a different name or path and then run it.  If
this method is used it must be done with this exposure in mind.  For
example:
user  ALL = ALL, !/usr/bin/vi

Does this hold true and how would I do it a different way?

example if I need the shells command change from :

Cmnd_Alias SHELLS=/usr/bin/ksh, /usr/bin/csh, /usr/bin/sh, /usr/bin/rsh, \
/bin/ksh, /bin/csh, /bin/sh, /bin/rsh

%kaysee       ALL=ALL,!SHELLS




____________________________________________________________
sudo-users mailing list <sudo-users at sudo.ws>
For list information, options, or to unsubscribe, visit:
http://www.sudo.ws/mailman/listinfo/sudo-users