sudo and entering a password to do so,
sudo remembers that we have entered a password and we do not have to enter a password the next time we use it.
I am concerned about the possibility of using this fact to trick a user (admin/sudoer) to execute a script that contains a
sudo command, so that the script can use administrator privileges.
A test using a directory and ls
I figured I could probably show that a script would ask for a password so that this trick could not work. I did the following test.
I created a directory testDir owned by root and using
chmod I deleted all the access priviliges of both the group (g) and others (o). I used
sudo to do so, so from now on assume we are in the "remember that the user does not need to enter a password to use sudo" state.
In testDir I created a testFile using
sudo (after this we don't need to enter a password to use sudo anymore).
Because I am not root,
ls testDir now tells me that permission is denied.
echo sudo ls testDir| bash prints testFile to the terminal.
The behavior appears to be the same if instead of piping "sudo ls testDir" to bash, we execute a shell script containing the line
sudo ls testDir.
Questions: Should you use caution when executing programs when you have just used