I need to prevent the shell escapes in our systems.These are the sudoers file entries.
Cmnd_Alias OD_DBA_2 = \ /bin/rm /*/apps/*, \ /bin/rm -[a-z]* /*/apps/*, \ /usr/local/bin/kill, \ /usr/bin/kill, \ /bin/su Cmnd_Alias NOEXEC_OD_DBA_2 = \ /bin/vi /root/*, \ /usr/bin/vim /root/* ipsqpx ALL = (root,admin,maq) \ OD_DBA_2, \ NOEXEC:NOEXEC_OD_DBA_2
However, after using the NOEXEC flag only for the two commands i.e vi and vim, the user ipsqpx is not able to use sudo /bin/su. The command returns the error.
/bin/su: /bin/bash: Permission denied
If I remove the line NOEXEC:NOEXEC_OD_DBA_2 then the user is able to do /bin/su. I'm not able to fix this.
I need to understand this behavior of the NOEXEC flag.