I have been asked to provide access to a stack of RedHat EL servers to an external discovery tool (and no is not an option). This tool requires access to a list of commands via sudo. Most of those are simple listings or can be locked down to one option. However, they also require sudo /usr/bin/find.
Obviously I am not happy about this, as find allows executing any command via -exec and friends, as well as deleting random files. It's as good as giving unrestricted root access.
I don't think a simple sudo command alias is going to help either, as it must necessarily include a wildcard for the path (1st argument), which will allow any subsequent argument as well. Is it at all possible/feasible to disable the insecure commands in /usr/bin/find when executed with sudo?
So to summarise:
Let normal finds happen: e.g.
/usr/bin/sudo /usr/bin/find /some/path/or/other -mtime +3 -print /usr/bin/sudo /usr/bin/find /home -executable -ls
Block use of exec/execdir/delete: e.g.
/usr/bin/sudo /usr/bin/find /some/path/or/other -name '*' -type f -exec /bin/rm -f {} \; /usr/bin/sudo /usr/bin/find / -ctime -1 -delete
$PATH
) normal users can use the full featured distro providedfind
while your special case can use/my/path/to/find
.