I have sudo access to one of our test machines and the following are the commands restricted for me:user_sree@sel8585:~> sudo -luser_sree's password:User user_sree may run the following commands on this host:    (ALL) ALL, (ALL) !/bin/sh, !/bin/bash, !/bin/ksh, (ALL) !/bin/su, (ALL) !/usr/bin/passwd, !/usr/sbin/useradd, !/usr/sbin/userdel, !/usr/sbin/usermod,    !/usr/sbin/visudoWhich says I cannot run visudo or /usr/sbin/visudo. And I confirmed this:user_sree@sel8585:~> sudo /usr/sbin/visudoSorry, user user_sree is not allowed to execute '/usr/sbin/visudo' as root on sel8585.Now, out of curiosity I created a symlink to /usr/sbin/visudo:ln -s /usr/sbin/visudo myvi`I tried accessing the sudoers file by calling this soft link and it works fine.user_sree@sel8585:~> sudo /home/user_sree/myvimyvi: /etc/sudoers.tmp unchangedSimilarly I was able to able to run other restricted commands by creating softlinks. If I am to configure sudo for others, how can I stop others from doing this? I do not want to restrict them creating softlinks.user_sree@sel8585:~> sudo -l | grep bash    (ALL) ALL, (ALL) !/bin/sh, !/bin/bash, !/bin/ksh, (ALL) !/bin/su, (ALL) !/usr/bin/passwd, !/usr/sbin/useradd, !/usr/sbin/userdel, !/usr/sbin/usermod,Similarly:user_sree@sel8585:~> sudo sh -c 'ls'Sorry, user user_sree is not allowed to execute '/usr/bin/sh -c ls' as root on sel8585.Now with the symlink mybash linked to /bin/bash: (in my system /usr/bin/sh is a link to /bin/bash)user_sree@sel8585:~> sudo /home/user_sree/mybash -c 'ls'bin  mybash  myvi  sudoers.back  test.ppuser_sree@sel8585:~> ll my*lrwxrwxrwx 1 user_sree users  9 Jul 16 14:10 mybash -> /bin/bashlrwxrwxrwx 1 user_sree users 16 Jul 16 14:13 myvi -> /usr/sbin/visudoP.S:Cmnd_Alias   NSHELLS = /bin/sh,/bin/bash,/bin/kshCmnd_Alias   NSU = /bin/suCmnd_Alias   NCMDS = /usr/bin/passwd,/usr/sbin/useradd,/usr/sbin/userdel,/usr/sbin/usermod,/usr/sbin/visudouser_sree ALL=(ALL) ALL, !NSHELLS, !NSU, !NCMDSThe above are the entries in the /etc/sudoers file.
Running sudo restricted commands by creating soft link
security;sudo
To be honest, if you're going to allow users to run everything except a few commands, you're going to run into problems. For example, you're disallowing access to the user* commands yet users can still run vipw or even just edit the password and shadow files using a text editor. And if you lock down access to vi for example, what's to prevent them installing a different text editor and using that? Or even using cat or the shell builtin echo to add a new user?You're never going to be able to give sudo access to everything except these few commands. Rather, remove the ALL entry, define what's allowed and give access only to those allowed commands.