From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 36D08158020 for ; Wed, 26 Oct 2022 23:07:55 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 3E504E09F7; Wed, 26 Oct 2022 23:07:50 +0000 (UTC) Received: from tncsrv06.tnetconsulting.net (tncsrv06.tnetconsulting.net [IPv6:2600:3c00:e000:1e9::8849]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id CC379E075F for ; Wed, 26 Oct 2022 23:07:49 +0000 (UTC) Received: from Contact-TNet-Consulting-Abuse-for-assistance by tncsrv06.tnetconsulting.net (8.15.2/8.15.2/Debian-3) with ESMTPSA id 29QN7mrr022652 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO) for ; Wed, 26 Oct 2022 18:07:48 -0500 Subject: Re: [gentoo-user] Update to /etc/sudoers disables wheel users!!! To: gentoo-user@lists.gentoo.org References: <20221026192203.4721a707@digimed.co.uk> <44b8fdd1-a618-ad1c-3b9b-e256ad555440@spamtrap.tnetconsulting.net> From: Grant Taylor Organization: TNet Consulting Message-ID: <45b54eef-a818-2fb8-321a-8526c12c346d@spamtrap.tnetconsulting.net> Date: Wed, 26 Oct 2022 17:06:51 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.13.0 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Archives-Salt: 037c261b-ece8-4bba-a9a3-fbbdc0f5dc84 X-Archives-Hash: cf3de1b1e73a5ff1538812df69673d56 On 10/26/22 3:48 PM, Ramon Fischer wrote: > I have created an issue at their Git repository. Maybe there will be > solution for this: > >    https://github.com/sudo-project/sudo/issues/190 I ... don't know where to begin. There are so many ways that you can hurt yourself with syntactically valid sudoers that it's not even funny. You could allow list almost all commands, without using the special ALL place holder and then remark critical commands and end up in a very similar situation. At some point we have to trust that Systems Administrators / Sudoers editors know what they are doing and let them do so. -- Grant. . . . unix || die