sudo and sudoers

What is sudo and sudoers?#

sudo checks the sudoers policy to decide whether you may run a command as another user. Rules look like user host = (runas) commands, for example alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl. sudo -l lists what the current user may run.

Why LinPEAS checks sudo and sudoers#

LinPEAS runs sudo -l (with a password if you supply -P), reads /etc/sudoers and /etc/sudoers.d/, and checks for sudo tokens and known sudo CVEs. A permissive rule is often the fastest privilege-escalation route to root.

What a normal configuration looks like#

Sudo access is limited to administrators, usually requiring the user's password, and scoped to what they actually need. NOPASSWD is used sparingly and only for safe, specific commands.

Why it can be security-sensitive#

Dangerous patterns include: (ALL) NOPASSWD: ALL; a rule allowing a binary that can spawn a shell or write files (many are catalogued on GTFOBins, e.g. find, vim, less, awk); wildcards that let you inject extra arguments; and preserved environment variables like LD_PRELOAD via env_keep.

How to check it manually#

Run these read-only commands to inspect this area yourself and validate what LinPEAS reports:

sudo -l

sudo cat /etc/sudoers; sudo ls -la /etc/sudoers.d/

sudo --version | head -1

Defensive remediation#

• Grant the minimum: specific commands, specific runas users, avoid ALL.
• Avoid NOPASSWD except for genuinely safe commands.
• Never allow binaries that can spawn shells or write arbitrary files unless required.
• Keep sudo patched; several serious CVEs (e.g. Baron Samedit) have affected it.
• Avoid env_keep for dangerous variables; drop the environment by default.