Re: root group in solaris

Tonnerre Lombard <tonnerre.lombard@xxxxxxxxxx> wrote on 09/26/2006
10:38:40 PM:
On Tue, 2006-09-26 at 17:09 -0700, Jonathan Leffler wrote:
What if one of the commands is /bin/ksh? Or if the person in
question
runs sudo /bin/ksh?

Download the source (v1.6.3 is available from SourceForge). Try it.
[...]

This is absolutely clear to me. I was thinking more in the lines of
"Wouldn't that give the user the right to do whatever he wants, even if
he didn't initially get the permission to do it in /etc/sudoers, and
wouldn't that give the user even the right to _change_ /etc/sudoers?"

Sorry - I misunderstood your concern.

Yes, it gives the user permission to do whatever he wants (which isn't
quite the same as the right to do whatever he wants - but the difference
would take some explaining). And yes, as I mentioned, the user could
change the sudosh log files, and /etc/sudoers, and so on.

I generally take the view that if you can't trust the users with root
privileges, you are in for a very difficult time - usually stated in the
more absolute form "root can do anything", where anything includes erasing
or replacing the o/s (though the reboot can be tricky over a network). It
might be over-simplistic as a view; it isn't too far removed from the
truth.

--
Jonathan Leffler (jleffler@xxxxxxxxxx)
STSM, Informix Database Engineering, IBM Information Management Division
4100 Bohannon Drive, Menlo Park, CA 94025-1013
Tel: +1 650-926-6921 Tie-Line: 630-6921
"I don't suffer from insanity; I enjoy every minute of it!"

Relevant Pages

  • Re: Absolute or relative paths
    ... pages in the root, but also has the disadvantage that the site has to be ... that create HTML or including chunks of HTML can be a problem because ... why not use absolute urls? ...
    (alt.html)
  • Re: [PHP] Question about using ftp_put() for copying files
    ... What puzzles me is that one path must be absolute and the other relative to the root. ... I know about ftp having its own root. ... I must first chdir to the $dist_dir. ...
    (php.general)
  • Re: Binary Tree Depth()
    ... Unless you had absolute height stored at the node. ... In that case it is Oas you examine the root. ... If you examine the root's left child, it indicates -1, if you examine the root's right child it indicates +1 ... The depth is the maximum depth of all branches. ...
    (comp.programming)
  • Re: Wisdom teeth extractions
    ... > 16 is not an absolute number ... I kinda thunk that already. ... >> advocates removing the crown and leaving the roots in place. ... >> state where the bone can form over the resulting root complex. ...
    (sci.med.dentistry)
Quantcast