> The intent is to have ability to restrict what code the user is allowed to run as the target user, and not allow arbitrary code execution. No, that's not the

> The intent is to have ability to restrict what code the user is allowed to run as the target user, and not allow arbitrary code execution. No, that's not the intent. The intent is at best to limit binaries that are being run, but actual implementation is to limit invocation string. > That is pretty crucial aspect of sudos use-case. Agreed. Unless you 100% vet and control all sudo`able binaries in your system (probably 99.9% sysadmins don't), it is pretty crucial to understand that effectively sudo grants arbitrary code execution under x user permissions. That's by design. Executed code runs "natively", not in any form of sandbox, without any restrictions on permissions besides local user account. Some applications are explicitly designed to allow arbitrary code execution, some applications may have bugs allowing arbitrary code execution. Sudo is insecure by design. The main use of sudo is to protect against willingly cooperating users.