I understand the script below has a serious problem, and NOEXEC and RESTRICT are not enough as a solution to this.
user ALL=(ALL) /usr/bin/vim /etc/httpd/confs/httpd.conf
However, I still have some confusion with these two options.
Due to the large number of programs that offer shell escapes, restricting users to the set of programs that do not is often unworkable.
Why is this a problem? I should not allow normal users to execute arbitrary commands, so restricting normal users to programs which do not allow shell escapes seems the same as sudoedit. How is this different from sudoedit?
The noexec feature is known to work on SunOS, Solaris, *BSD, Linux, IRIX, Tru64 UNIX, MacOS X, HP-UX 11.x and AIX 5.3 and above.
If you are unsure whether or not your system is capable of supporting noexec you can always just try it out and check whether shell escapes work when noexec is enabled.
Is there a good way to check if NOEXEC works well or not? Is trying commands out the safest?
man page: http://www.sudo.ws/sudoers.man.html