3 ms·

Isn't 'sudo vi' already game over? :sp /bin/vi ... :wq

• klodolph 14y ago
  > Isn't 'sudo vi' already game over? Yes, I wasn't very clear when I said the following... > Okay, so you're a good admin and disabled that. What I mean is that you disable "sudo vi" access, and allow "sudoedit" access. Suddenly you only have write access to certain files. But which files? These people need to administer the server, but at the same time you want to prevent them from creating a backdoor, or at least you want to know about it if they do. /etc/crontab is just an obvious example. Maybe you can get suborn a filter somewhere that runs as root, or poison the environment variables of a legitimate script.