What is "ALL ALL=!SUDOSUDO" for?

Question

The last line of the /etc/sudoers file is:

grep -i sudosudo /etc/sudoers
Cmnd_Alias SUDOSUDO = /usr/bin/sudo
ALL ALL=!SUDOSUDO

why? What does it exactly do?

UPDATE#1: Now I know that it prevents users to use the: "/usr/bin/sudo".

UPDATE#2: not allowing "root ALL=(ALL) ALL" is not a solution.

Updated Question: What is better besides this "SUDOSUDO"? (the problem with this that the sudo binary could be copied..)

SUDOSUDO is probably an alias. Does it exist elsewhere in the file? — Chris Down, Commented Dec 6, 2012 at 12:53
is "ALL ALL=!SUDOSUDO" as the last line is like when having DROP iptables POLICY and still using a -j DROP rule as last rule in ex.: INPUT chain? :D or does it has real effects? — gasko peter, Commented Dec 6, 2012 at 14:30
I'm not 100% sure, but I believe it only prevents anyone from running sudo sudo .... — Kevin, Commented Dec 6, 2012 at 14:48

Mark Cohen · Accepted Answer · 2012-12-06 17:03:41Z

4

That is to prevent someone from running sudo sudo, but it's not very effective.

It is easily circumvented by copying the sudo binary to another location. for example: cp /bin/sudo /sbin/sudo; sudo /sbin/sudo su -.

Best thing to do is not allowing "root ALL=(ALL) ALL"

answered Dec 6, 2012 at 17:03

Mark Cohen

1,3629 silver badges12 bronze badges

4

Why would somebody want to disallow running sudo with sudo?
– user26112
Commented Apr 10, 2013 at 13:01
3

Why would you run sudo sudo?
– Alko
Commented Aug 12, 2013 at 12:22

Add a comment |

1 Answer 1