Why does visudo discourage other editors?

Question

man visudo explains that visudo will not (by default) use EDITOR or VISUAL environment variables.

It states that

"There is no easy way to prevent a user from gaining a root shell if the editor used by visudo allows shell escapes."

Now I am confused where the security risk lies. I believe that

• only root can use visudo to edit /etc/sudoers
• only root can change root's environment variables
• root already has a root shell

There is probably a use case where this does not hold, but I can't think of it.

Answer 1

I don't think there is an additional security risk from running an arbitrary editor from visudo strictly speaking. Clearly, the user running visudo already has permissions to edit /etc/sudoers, and therefore has the ability to add rules that will allow execution of any other commands on the system. So regardless of which editor is run, a user that can visudo can already execute whatever they want indirectly by adding a new sudo rule.

I think the advisory in the documentation about the EDITOR and VISUAL environment variables is about executing a root shell (or arbitrary command) while bypassing sudo's standard logging. By default, sudo logs all successful and unsuccessful authentications to syslog. This gives the system administrator an audit trail about which users are executing which commands through sudo. If a user changes /etc/sudoers with visudo, that can be seen by checksumming or reviewing the file. However, if a user can get a root shell through visudo, they can execute arbitrary commands without any audit trail.

So the security risk is the same as granting permission to run sudo bash, namely that a user with that privilege can get a root shell and execute arbitrary code without any restriction or logging of the commands that are run.