I have tried to restrict user by editing
M ALL=!/bin/su. I am able to restrict
sudo su - but not
For your original question, you will need to exclude
/bin/bash (or whatever is defined as the user's shell in
/etc/passwd), like so:
tomk ALL= ALL,!/bin/su,!/bin/bash
However(!!!), as stated already in the comments to your question, even though this will deny the user from running
sudo -s or
sudo -i, it will not really prevent him/her from getting an interactive shell as root.
Limitations of the ‘!’ operator
It is generally not effective to “subtract” commands from ALL using the ‘!’ operator. A user can trivially circumvent this by copying the desired command to a different name and then executing that. For example:
bill ALL = ALL, !SU, !SHELLS
Doesn't really prevent bill from running the commands listed in SU or SHELLS since he can simply copy those commands to a different name, or use a shell escape from an editor or other program. There‐ fore, these kind of restrictions should be considered advisory at best (and reinforced by policy).
In general, if a user has sudo ALL there is nothing to prevent them from creating their own program that gives them a root shell (or making their own copy of a shell) regardless of any ‘!’ elements in the user specification.