I want to prevent users who need escalated privileges from obtaining any kind of a root shell. However since there are many ways to attain this, and many non root commands ( like those found in coreutils ) I'm wondering if there are any downloadable sudoers policies that provide restrictive access.

  • 2
    What is the difference between them having a shell and just using sudo to execute the commands? You can give them access to only a certain command (or, I believe, a list), is that what you want? – Kevin Nov 24 '11 at 19:58
  • 4
    I genuinely don't understand what you're asking. Could you please clarify your question? – Chris Down Nov 24 '11 at 21:04
  • Are there any special programs that give you headaches? – Nils Nov 24 '11 at 21:33
  • 1
    The only safe sudoers is an empty sudoers. By default, assume that any command has a shell escape. Running a specific command with escalated privileges corresponds to exceptional needs, and you need to study each exception. I don't understand what you're after: a list of safe commands? That doesn't exist; the vast majority of safe commands are useless. – Gilles Nov 25 '11 at 2:07
  • I want to know if there are any downloadable policies that provide a list of common shell programs that do not provide a shell themselves so to speak. I'm basically looking for a preexisting security policy, though such a thing may not exist in any distributable form (outside of the default sample) – xenoterracide Nov 25 '11 at 21:24



sudo allows you to give users and groups super user privileges. sudo's configuration file can be found at /etc/sudoers. Typically, one edits the sudoers file using the command visudo. By default on most distributions, either no user is given sudo privileges, or the first user created is given such privileges. After that, users are typically created without sudo privileges.


sudo allows you to give each user different settings, or even apply settings to groups of users. For example, you could give the user admin or the group admins access to gain super user privileges.

You can also allow these users access to specific programs. For example, you can give Bob sudo access to apt-get if you trust Bob to install packages and update packages on your system.

Your system most likely has a sudoers file, in which case you can open the file and see the examples provided. I will show you an example here that might clear things up:

# Allow members of group sudo to execute any command

This gives any user in the group of sudo privileges to run any command anywhere without prompting for a password. The user must first authenticate (ie: login), but once that happens, these users will have root access to the machine.


Most distributions give the initial user sudo access, but users created thereafter are not given such access. You can verify this by viewing /etc/sudoers. Simply make sure users have no access to sudo via sudoers file to ensure no user can gain root shell via sudo.


I'm not sure I understand the question. However, if you grant some user root permissions (through sudo or whatever) to execute a program and that this program happens to provide access to a shell with these same permissions, you can't do anything against it.

When you give some permissions to execute a specific program you have to trust the program for not messing up (except, of course, if you really trust the user).


Are you looking for something like this:

# Allow members of group sudo to execute any command
username  ALL = ALL, !/bin/sh, !/bin/bash, !/bin/tcsh, !/bin/csh, !/bin/ksh, !/bin/zsh, !/bin/su
  • essentially, though more comprehensive – xenoterracide Oct 3 '12 at 9:26
  • 3
    You forgot shutdown, halt, mkfs, dd... IMO there is no secure way maintaining a blacklist of possible dangerous programs. Go with a whitelist instead and think very hard why you would want users to have root-privileges in the first place. – Alexander Janssen Oct 3 '12 at 12:05
  • @xenoterracide: +1 for Alex. There is no secure way to maintain a blacklist. A user can always cp /bin/sh ~/not_a_shell ; sudo ~/not_a_shell or sudo ex +':!/bin/sh'. Rather than trying to make it impossible, provide a supported/approved way that will audit and make people justify any elevation to full root. – bahamat Oct 3 '12 at 18:04
  • well this is why I was asking if there are any downloadable policies... obviously publicly audited tools/policies are more secure than me or someone just coming up with them myself. – xenoterracide Oct 4 '12 at 2:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.