Lesson 2.17: sudo rules that give away root
sudo can grant one command instead of everything, but a narrow-looking rule can still be a full root shell: editors and pagers can start a shell, find and tar can run commands, wildcards match more than intended, and NOPASSWD removes the last check. How to read sudo -l like an attacker would and fix it like a defender: sudoedit for editing files, exact commands, no wildcards, passwords required, and visudo -c before saving. In the lab you review a web developer's rules, replace an editor rule with sudoedit, remove a forgotten 'temporary' rule, and verify the result.
17 min
You will learn to
- Read sudo -l output critically
- Explain why editors, pagers and find in sudo rules give root
- Use sudoedit instead of sudo vim
- Avoid wildcards and NOPASSWD
- Validate sudoers with visudo -c
Key terms
- sudoers rule
- A line of the form who host=(as-whom) commands.
- NOPASSWD
- A tag that lets the user run the command without typing their password.
- Shell escape
- A feature of a program that starts another command or shell, inheriting its rights.
- sudoedit
- Safe file editing with sudo: the file is copied, edited by the user's own editor running as the user, then copied back.
- visudo
- The tool for editing sudoers with a syntax check before saving; -c checks without editing.
← Subnets and CIDR: dividing a network · All lessons · Storing and checking passwords →