3

The last line of the /etc/sudoers file is:

grep -i sudosudo /etc/sudoers
Cmnd_Alias SUDOSUDO = /usr/bin/sudo
ALL ALL=!SUDOSUDO

why? What does it exactly do?

UPDATE#1: Now I know that it prevents users to use the: "/usr/bin/sudo".

UPDATE#2: not allowing "root ALL=(ALL) ALL" is not a solution.

Updated Question: What is better besides this "SUDOSUDO"? (the problem with this that the sudo binary could be copied..)

4
  • SUDOSUDO is probably an alias. Does it exist elsewhere in the file?
    – Chris Down
    Dec 6, 2012 at 12:53
  • question updated :D - so what does it means exactly? Dec 6, 2012 at 14:21
  • is "ALL ALL=!SUDOSUDO" as the last line is like when having DROP iptables POLICY and still using a -j DROP rule as last rule in ex.: INPUT chain? :D or does it has real effects? Dec 6, 2012 at 14:30
  • I'm not 100% sure, but I believe it only prevents anyone from running sudo sudo ....
    – Kevin
    Dec 6, 2012 at 14:48

1 Answer 1

4

That is to prevent someone from running sudo sudo, but it's not very effective.

It is easily circumvented by copying the sudo binary to another location. for example: cp /bin/sudo /sbin/sudo; sudo /sbin/sudo su -.

Best thing to do is not allowing "root ALL=(ALL) ALL"

2
  • 4
    Why would somebody want to disallow running sudo with sudo?
    – user26112
    Apr 10, 2013 at 13:01
  • 3
    Why would you run sudo sudo?
    – Alko
    Aug 12, 2013 at 12:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .