Re: Restricting / Limiting permission/ownership of targetted binaries?

On 4/26/21 7:25 AM, A. James Lewis wrote:
Hi,
> I've been trying to figure out if there's a way to cause sudo to 
> validate that a particular binary has "secure permissions", before 
> allowing it to run, in the same way that sshd will not use an 
> "authorized_keys" file if it has insecure permissions.

If someone can change permissions on sudo,
wouldn't that mean they could turn off any other permission checks
on the binary?  'ssh/d' does checks on files owned by the user
which the unprivileged, owning user can misconfigure.
The permissions on 'sudo' can only be set by 'root' so the only
misconfiguration of permissions would have to be done by root, no?


____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users