Score:1

How to disable execution of arguments to a command sudo

How to disable execution of arguments to a command sudo. My sudoers.d/test, dont' work. I need to disable the argument -i.

test ALL = (ALL:ALL) ALL, !/usr/bin/sudo [!-]*
pasman pasmański avatar
mx flag
It is possible with sudo regular expressions. Unfortunately in Ubuntu 23.04 and above.
Score:1
it flag

I found an answer at the Unix & Linux regarding same question.

Link to answer Credit to user Tom Klino

Copy paste from said link: For your original question, you will need to exclude /bin/bash (or whatever is defined as the user's shell in /etc/passwd), like so:

tomk ALL= ALL,!/bin/su,!/bin/bash

However(!!!), as stated already in the comments to your question, even though this will deny the user from running sudo -s or sudo -i, it will not really prevent him/her from getting an interactive shell as root.

From man sudoers:

Limitations of the ‘!’ operator

It is generally not effective to “subtract” commands from ALL using the ‘!’ operator. A user can trivially circumvent this by copying the desired command to a different name and then executing that. For example:

bill    ALL = ALL, !SU, !SHELLS

Doesn't really prevent bill from running the commands listed in SU or SHELLS since he can simply copy those commands to a different name, or use a shell escape from an editor or other program. There‐ fore, these kind of restrictions should be considered advisory at best (and reinforced by policy).

In general, if a user has sudo ALL there is nothing to prevent them from creating their own program that gives them a root shell (or making their own copy of a shell) regardless of any ‘!’ elements in the user specification.

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.