Sudoers can't prevent commands from executing from bash shell script

Question

I want to prevent users using "sudo rm" form anywhere.
I have edited sudoers:

Members of the admin group may gain root privileges

%admin ALL=(ALL) ALL,!/bin/rm

And ok：

derek@derek-desktop:~$ sudo rm

Sorry, user derek is not allowed to execute '/bin/rm' as root on derek-desktop.

But I create a test.sh with a rm command

derek@derek-desktop:~$ cat test.sh
rm --help

It show me the rm help. Seems sudoers can't prevent this behavior. I want to disable all the users running rm from sudo.
Can you help me? Thanks in advance!

bsmoo · Accepted Answer · 2013-04-05 10:42:43Z

1

What you have added to the sudoers works fine. It prevents users in the admin group from running sudo rm anywhere on the server. However, it doesn't stop them from running rm

If you change test.sh to have sudo rm --help this will error.

If you don't trust a user to run the rm command maybe you could create an if statement in the global bash.bashrc such as....

group=`groups`
if [[ $group == *admin* ]] ; then
        alias rm=''
        alias unalias=''
fi

Hope this offers a somewhat alternative to your question.

answered Apr 5, 2013 at 10:42

bsmoo

1,0694 gold badges12 silver badges24 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Sudoers can't prevent commands from executing from bash shell script

Members of the admin group may gain root privileges

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

Members of the admin group may gain root privileges

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related