Why Linux allow sudo -i or sudo su

Question

I have a question recently discover that apparently you can 'bypass' the needs to know root user password and just switch straight in as root user. So if you are the admin, you can have some users with sudo group level privileges. And without giving them root password, they will not able to login or switch to root user (normal condition ofc). Now they will require to enter sudo command to do any root admin level commands or operations. But they can also just do sudo su or sudo -i to switch to root user without knowing root user password. Now i have two big issues with this:

1. In my opinion (correct me if i am wrong) - this is a big issue for security and also defeat the whole purpose of Linux structures. Because now they are as root does not need to know the root password.
2. Auditing and logging - They are now as root, and those behaviour or actions run from user root are not logged without installing any third party auditd systems or tools.

I guess my questions is why linux allow this. For me this seems like a cheat bypass code.

Please correct me if my concerns or opinion are wrong. thanks

Answer 1

The purpose of sudo command is to allow non-root user run commands as root, not prevent them from running these commands (especially on systems where you don't login as root at all, like Ubuntu). So by design, sudo allows running a shell as root as well.

If you want to restrict which commands your users can run via sudo, you can precisely control it using /etc/sudoers file. I suggest you read the documentation for that file (man sudoers).

Answer 2

if you are the admin, you can have some users with sudo group level privileges

Well, yes. If you're the admin, you can be the admin…

they can also just do sudo su or sudo -i to switch to root user without knowing root user password

Yes, they can, if they have been explicitly authorized to do so by adding the appropriate lines in the sudoers file. If you don't want to allow users to run commands as root, don't allow them access to the root account, via sudo or otherwise.

now they are as root does not need to know the root password

Yes, so what? Giving someone the root password is one method to allow them to access the root account. Making someone a sudoer (i.e. allowing them to run arbitrary commands as root via sudo) is another.

They are now as root, and those behaviour or actions run from user root are not logged without installing any third party auditd systems or tools

Yes, so what? Being root allows them to turn off auditing and to delete logs. (Except logs stored on a remote machine; then, at most, you can guarantee that the logs will contain the way the users gained root access.)

If your concern is that users can run a shell as root, and you'd want them to “only run specific commands”: a shell is a specific command. sudo -i is a shortcut for running the target user's default shell: it's equivalent to sudo bash or sudo sh or sudo zsh or similar. If you wanted to block users from running a shell as root, you'd need to block sudo sh as well. And sudo perl. And sudo vi (can run ![any shell command]). And so on. Or they could write eval "$(stdin)" into an executable file and run that with sudo. Or they could run sudo visudo and edit the sudoers rules. There's no way to allow a user to run almost every command and only block a few. If you give someone root access, they have root access and you have to trust them. If you don't trust them, don't give them root access.