Thing is, with sudo you can limit which commands you're able to run. i.e.: regular users can run `sudo` but just the `mount` binary, because they're expected to

Thing is, with sudo you can limit which commands you're able to run. i.e.: regular users can run `sudo` but just the `mount` binary, because they're expected to mount stuff that's not on the fstab (whatever). That can look safe at first glance, but then you can exploit that binaries to get some other unexpected results: Change your mount binary for a privileged shell: sudo mount -o bind /bin/sh /bin/mount Run a privileged shell from inside vim: sudo vi -c ':!/bin/sh' /dev/null And so on...