0

I have the following problem:

I configured sudo with permissions for everything except for a few commands, remove, reboot, shutdown, block from sudo to shell, preventing a user from elevating the privileges with the sudo -i command or change the password for example.

If someone runs the command sudo vim and opens a shell from within the editor, it manages to elevate the privilege to root.

Does anyone know of any way to block this command, from within the editor?

Anthony Geoghegan
  • 12,605
  • 7
  • 59
  • 62
Giuliano Domingues
  • 1
  • 1
  • 1
  • 2
    Well, you have `rvim` (restricted vim) which doesn't allow shell commands; but using `sudo` with permissions to everything is the same as giving everybody root. (and using `sudo` *at all* is a horrible idea in the 1st place no matter how, where or when). –  Jan 30 '19 at 20:15
  • Yes I agree. But their service involves oracle database with specific commands that require elevation and that would have to put them in the whitelist one by one. The big problem is that passing this way rvim does not work. I've tried this. – Giuliano Domingues Jan 30 '19 at 20:20
  • @AnthonyGeoghegan No worries, it happens. – Rui F Ribeiro Jan 30 '19 at 20:57
  • Related https://unix.stackexchange.com/q/429374/117549 – Jeff Schaller Jan 30 '19 at 21:11
  • I haven't used Oracle for a few years, but nothing needed root access except a couple shell scripts during installation that had to write in /etc and /usr/local/bin. What commands must run a root vim? Maybe we can give you an alternative that doesn't need root but can use groups or ACLs. – Mark Plotnick Jan 31 '19 at 00:41
  • Is `:sh` meaningfully different to `i/bin/sh:w mysh^M:q` / `chmod a+rx mysh` / `sudo ./mysh` for your threat model? – Michael Homer Jan 31 '19 at 02:17

1 Answers1

2

Blacklisting commands from sudo and allowing everything else is a bad idea. One could simply copy /bin/bash to another location and start it using sudo. Use whitelisting for commands that are really needed for users.

Cornholio
  • 166
  • 4
  • This server is used by third party company. And was granted sudo access. Here's an example: User_Alias PARTNER = %partner Cmnd_Alias SHELL = /bin/sh,/bin/bash... Cmnd_Alias DENIED = /bin/su, /usr/sbin/visudo, /usr/bin/passwd root, /usr/bin PARTNER ALL=(ALL) NOPASSWD: ALL, !DENIED, !SHELL – Giuliano Domingues Jan 30 '19 at 20:13
  • @GiulianoDomingues You should edit your question to include all relevant details, including what you've already tried. Questions should be self-contained as many potential answerers won't have time to read all the comments. See [ask] for more useful tips. – Anthony Geoghegan Jan 30 '19 at 20:27