Edit - Unix & Linux Stack Exchange

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

Rev

I was kind of hoping to avoid the "Don't do this" responses with the "this is an example" text, but I guess it was always inevitable. Nevertheless, thank you for the rest of the post which is very informative. I tried putting the two tags together, but the second was interpreted as a command alias. I notice that you have no space between the two, which was, I suspect my problem. Anyway, I upvoted you and thanks again. What's your take on @Ruis' comment, which was the conclusion I was coming to?

Graham Nicholls
– Graham Nicholls

2018-10-08 13:01:33 +00:00
Commented Oct 8, 2018 at 13:01
2

I tend to agree with him: if you allow all commands, preventing the shell escapes is the least of your worries. Although I'd say that noexec may have its place when you need to grant some user(s) permission to use some specific tool that requires high privileges and just happens to include shell escape functionality.If you plan to use sudo as you describe to satisfy a requirement to log all privileged commands, see the auditd suggestion in this Server Fault post.

telcoM
– telcoM

2018-10-08 13:21:56 +00:00
Commented Oct 8, 2018 at 13:21
Actually, @Rui 's comment was stronger that that - don't use sudo at all if you're concerned about shell escapes - any comment on that?

Graham Nicholls
– Graham Nicholls

2018-10-08 14:57:41 +00:00
Commented Oct 8, 2018 at 14:57
2

If you want to give an user a form of limited root access for the purpose of running some program, it is your responsibility as a sysadmin to carefully go through the features of the program and ensure that it contains no shell escapes. If it contains a shell escape, then - after careful testing - you can maybe allow it with NOEXEC. Just slapping NOEXEC on everything is the wrong and dangerous kind of lazy way.

telcoM
– telcoM

2018-10-08 15:32:28 +00:00
Commented Oct 8, 2018 at 15:32

Add a comment |

Correct minor typos or mistakes
Clarify meaning without changing it
Add related resources or links
Always respect the author’s intent
Don’t use edits to reply to the author

create code fences with backticks ` or tildes ~
```
like so
```
add language identifier to highlight code
```python
def function(foo):
print(foo)
```
put returns between paragraphs
for linebreak add 2 spaces at end
_italic_ or **bold**
indent code by 4 spaces
backtick escapes `like _so_`
quote by placing > at start of line
to make links (use https whenever possible)

<https://example.com>

[example](https://example.com)

<a href="https://example.com">example</a>

formatting help »
answering help »