Shell escapes, NOEXEC, and sudoedit

Most over-grants in production sudoers files are not written by careless people. They are written by careful people who believed a rule was bounded when it was not.

sudo checks the command line, then calls execve(). After that it has no further control. Whatever it started is root, and whatever that program can be persuaded to do, root does.

The grammar trap

man 5 sudoers states the rule plainly:

A command name is a fully qualified file name which may include shell-style wildcards. A simple file name allows the user to run the command with any arguments they wish.

A rule that names only a path grants that command with every possible argument. This one looks like least privilege:

%backup ALL=(root) /usr/bin/rsync

It is not. rsync copies any path to any path as root, and --rsh runs a command of your choosing. Three of the many consequences:

The group has root. Nobody wrote ALL, and nobody had to.

The three escape classes

Before granting any command, ask which of these it can do as root. If the answer is any of them, the unpinned grant is ALL.

GTFOBins catalogues these breakouts binary by binary. Treat it as the checklist you run before writing a grant, not the report you read after the incident.

Pinning arguments

If a rule lists arguments, the command line must match them exactly. Three forms matter:

# Exactly these arguments, nothing else.
%ops ALL=(root) /usr/bin/systemctl restart nginx

# No arguments at all are permitted.
%backup ALL=(root) /usr/local/sbin/backup-run.sh ""

# Any trailing arguments are permitted - use with care.
%ops ALL=(root) /usr/bin/systemctl restart *

The "" form is the strongest thing you can write, and it is the right form for a wrapper script that takes no input.

The trailing * form is weaker than it looks. systemctl restart * permits restarting any unit on the host, including one the operator just wrote into a directory they control.

NOEXEC

NOEXEC: tells sudo to stop the command it launches from launching anything else. This is the man page’s own example:

aaron shanty = NOEXEC: /usr/bin/more, /usr/bin/vi

The implementation differs by build. Todd Miller’s sudo preloads sudo_noexec.so, which stubs out the exec family - so it does not cover statically linked binaries. sudo-rs installs a seccomp() filter instead, which also covers static binaries.

Apply it per rule, per alias, or globally with an escape hatch:

Cmnd_Alias VIEW = /usr/bin/less /var/log/audit/audit.log
Defaults!VIEW noexec

# Or globally, with explicit exceptions:
Defaults noexec
%deploy ALL=(root) EXEC: /usr/local/sbin/deploy.sh ""

sudoedit

sudo vi /etc/nginx/nginx.conf runs an editor as root. That editor can shell out and can write anywhere. The file being edited is irrelevant to what the grant actually permits.

sudoedit (also sudo -e) inverts the model:

1. sudo copies the target file to a temporary file.
2. Your editor runs as you, with your privileges.
3. sudo copies the result back, preserving owner and mode.

The editor never runs as root, so there is nothing to escape from. Grant it by the built-in name, with no leading path:

# Correct - the sudoedit built-in.
%web ALL=(root) sudoedit /etc/nginx/nginx.conf

# Wrong - this grants nothing useful, and /usr/bin/vi
# would grant a root editor instead.
%web ALL=(root) /usr/bin/sudoedit /etc/nginx/nginx.conf

$ sudo -l -U webops

User webops may run the following commands on web01:
(root) sudoedit /etc/nginx/nginx.conf
(root) NOEXEC: /usr/sbin/nginx -t
(root) /usr/bin/systemctl reload nginx

The wrapper pattern

When the task genuinely needs a powerful tool, the grant goes to a script you reviewed, not to the tool:

#!/bin/bash
# /usr/local/sbin/backup-run.sh - root:root 0755
set -euo pipefail
exec /usr/bin/rsync -a --delete \
  --exclude-from=/etc/backup/excludes \
  /srv/data/ /mnt/backup/srv-data/

%backup ALL=(root) /usr/local/sbin/backup-run.sh ""

The rules that make the pattern hold:

• The script takes no operator-supplied paths. If something must vary, accept a name and map it to a path inside the script.
• The script is owned by root and not writable by the granted group. If %backup can edit the wrapper, %backup has ALL.
• Every path inside the script is absolute. Defaults secure_path and env_reset are on by default; do not disable them for the rule.

$ find /usr/local/sbin -maxdepth 1 -type f -perm /go+w -printf '%p %M %u:%g
'

/usr/local/sbin/backup-run.sh -rwxrwxr-x root:backup

Reviewing an existing policy

$ sudo grep -REv '^[[:space:]]*(#|$)' /etc/sudoers /etc/sudoers.d/

/etc/sudoers.d/40-backup:%backup ALL=(root) /usr/bin/rsync
/etc/sudoers.d/50-ops:%ops ALL=(root) NOPASSWD: /usr/bin/journalctl
/etc/sudoers.d/60-app:%app ALL=(root) /usr/bin/tar

1. For every rule, list the commands it grants. Resolve Cmnd_Alias entries first.
2. For each command, ask the three questions: can it spawn a subprocess, write an arbitrary path, or evaluate code or config?
3. If the answer is yes and the rule has no argument list, treat it as a (ALL) ALL grant and raise it as a finding.
4. Rewrite it: pin the exact arguments, or replace the tool with a reviewed wrapper granted with the "" argument.
5. Add NOEXEC: to any leaf tool - editor, pager, viewer - that has no reason to spawn anything.
6. Replace every sudo <editor> grant with sudoedit <file>.
7. Confirm each wrapper is root-owned and not writable by the granted group.
8. Validate with visudo -c -f FILE, then confirm the result with sudo -l -U <user>.

Knowledge check