2 ms·

Yes, just put a bash script called ls $HOME/bin, put that directory in $PATH, run sudo ls, and off you go... Hopefully you would not be white-listed to run thi

Yes, just put a bash script called ls $HOME/bin, put that directory in $PATH, run sudo ls, and off you go... Hopefully you would not be white-listed to run things like that (always put the full path in sudoers), so you will need some sort of "obviously bash" in the log, but we all know what we have done at moments of interaction with paper-cuts. We have probably all lessened our security to ease discomfort here and there.

jtgeibel 12y ago
I've tested this on both Ubuntu 14.04 and CentOS 6.5, and they both sanitize the path variable such that this is not possible. I believe this is controlled via the secure_path setting in your /etc/sudoers file.
cesarb 12y ago
When I ran "sudo ls", the command that was logged was "/bin/ls", so putting a different ls in $PATH would not trick sudo's logging.