Unix administration - Re: Beginner Question: Allowing sudo to vi hosts file

Author

Re: Beginner Question: Allowing sudo to vi hosts file

implicate_order

2006-07-19, 1:40 pm

> Very, very dangerous! PLEASE DON'T! You can shell escape from vi
> so you made the person root.
>
> Simply change permissions to 664 and assign some group to the file
> and make the user member of this group. Check for cron jobs or
> alike running regular checking and possibly reseting permissions.
>

Couldn't someone configure the sudoers file to implement the NOEXEC
directive? This is specifically provided to prevent shell escapes from
editors such as vi. This might call for a recompile of sudo binaries.

http://sudo.rtin.bz/sudo/man/sudoer...noexec_and_exec
http://sudo.rtin.bz/sudo/man/sudoer...g_shell_escapes