I want to prevent users who need escalated privileges from obtaining any kind of a root shell. However since there are many ways to attain this, and many non root commands ( like those found in coreutils ) I'm wondering if there are any downloadable sudoers policies that provide restrictive access.
sudo allows you to give users and groups super user privileges. sudo's configuration file can be found at /etc/sudoers. Typically, one edits the sudoers file using the command visudo. By default on most distributions, either no user is given sudo privileges, or the first user created is given such privileges. After that, users are typically created without sudo privileges.
sudo allows you to give each user different settings, or even apply settings to groups of users. For example, you could give the user admin or the group admins access to gain super user privileges.
You can also allow these users access to specific programs. For example, you can give Bob sudo access to apt-get if you trust Bob to install packages and update packages on your system.
Your system most likely has a sudoers file, in which case you can open the file and see the examples provided. I will show you an example here that might clear things up:
# Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) NOPASSWD:ALL
This gives any user in the group of sudo privileges to run any command anywhere without prompting for a password. The user must first authenticate (ie: login), but once that happens, these users will have root access to the machine.
Most distributions give the initial user sudo access, but users created thereafter are not given such access. You can verify this by viewing /etc/sudoers. Simply make sure users have no access to sudo via sudoers file to ensure no user can gain root shell via sudo.
I'm not sure I understand the question. However, if you grant some user root permissions (through sudo or whatever) to execute a program and that this program happens to provide access to a shell with these same permissions, you can't do anything against it.
When you give some permissions to execute a specific program you have to trust the program for not messing up (except, of course, if you really trust the user).
Are you looking for something like this:
# Allow members of group sudo to execute any command username ALL = ALL, !/bin/sh, !/bin/bash, !/bin/tcsh, !/bin/csh, !/bin/ksh, !/bin/zsh, !/bin/su