I need to prevent the shell escapes in our systems.These are the sudoers file entries.

Cmnd_Alias OD_DBA_2 = \
                          /bin/rm /*/apps/*, \
                          /bin/rm -[a-z]* /*/apps/*, \
                          /usr/local/bin/kill, \
                          /usr/bin/kill, \

Cmnd_Alias NOEXEC_OD_DBA_2 = \
                      /bin/vi /root/*, \
                      /usr/bin/vim /root/*

ipsqpx  ALL = (root,admin,maq) \
                OD_DBA_2, \

However, after using the NOEXEC flag only for the two commands i.e vi and vim, the user ipsqpx is not able to use sudo /bin/su. The command returns the error.

/bin/su: /bin/bash: Permission denied

If I remove the line NOEXEC:NOEXEC_OD_DBA_2 then the user is able to do /bin/su. I'm not able to fix this.

I need to understand this behavior of the NOEXEC flag.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.