Re: root group in solaris

Tonnerre Lombard <[email protected]> Tue, 19 Sep 2006 08:11:29 +0200
Newsgroups gmane.comp.security.sun
Organization SyGroup GmbH
Message-ID <[email protected]>
Salut,

On Mon, 2006-09-18 at 15:43 -0400, Curt Tucker wrote:
> Of course, someone with sudo rights to ALL like this can easily get 
> around not being able to "sudo su -" in a dozen ways (like "sudo 
> /bin/ksh", etc.).

You tend to forget about the builtin sudo -s

Also, what about sudo visudo or sudo vi /etc/sudoers? One could easily
get around this restriction that way too.

There is no way to protect yourself from root privileges except by
limiting the code that may be executed (e.g. via a setuid binary or by
limiting the executable system calls).

				Tonnerre
-- 
SyGroup GmbH
Tonnerre Lombard

Loesungen mit System
Tel:+41 61 333 80 33    Roeschenzerstrasse 9
Fax:+41 61 383 14 67    4153 Reinach BL
Web:www.sygroup.ch      [email protected]
signature.asc (application/pgp-signature, 824 B)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (NetBSD)

iQIVAwUARQ+KEO1mMGan/TnWAQLjjQ/9ExB0RFDXxqdSOvILmeduHexjphMTfeKk
jeCpGW7o3duzzGJrkRVQ6y4yNDV3IGMBR4pofnXAzkiFb592WUMt6ByviMV9PG99
bunSK8iDegPDcpCbQgr2otoU7gJmZ+IqVPbYeo1tr1LpIBlbqrXW0V3o27w8bP+T
D64OohONL/gk2HDBRCLfzz7f/a1kPC30pB+5cHh3zKJ+7plILL7OJVWXb6EqABC6
BkV+RsuUBcz62sFuQe3doOjeRNAIcGRyzr6F+jP8WD3/DExStiJ91Zc7t3Ea85Jf
P+uw7Vvaoi3lju2CWLpnQaXwh3231A/48RySgSMSCQmGWcKNi8K+KsoFi/ndlO+6
Lz1eptejjEg7SNA6dqUaNG0JIOzEdRJ3ZfsN15RXO7B8nTdhPmdkspZvvH6qZsUN
rzCn3+nI1k/0h3Di5x/4/KGpv8SUYVPlVX4Lbh2GnWHsyaDuwb3G6BUlpjLo0/a0
cUgoGS7Bsp6kEVfPs7YYddlwZHT0NFitBjVF5M9Babz/jRQcig66I15azw4o3WpJ
ZJZB+pvSEY9RHe71MMqCxEus69bsRG+kcDypLtnsjBJy3xUFTGJDnjYomQgKuMjT
9W9sXkghvCSyK8gn/UvhyV4ugvc9+5WWxl10xdVKyQ4MIfuelgw31xoVScboMhHd
ub0qtwFjcNA=
=NG5a
-----END PGP SIGNATURE-----