UNIX for Advanced & Expert Users

Are you sure this is working for you with a user which has /etc/sudoers entry similar to what you posted?

Because, it does not work for me (which is a good sign) with the similar setup:

Code:

[testuser@blue testuser]$ sudo cp /bin/sh /usr/bin/blahblah
[sudo] password for testuser:
Sorry, user testuser is not allowed to execute '/bin/cp /bin/sh /usr/bin/blahblah' as root on blue.
[testuser@blue testuser]$

Although my knowledge is limited to AIX, Solaris and Linux, I have seen vi to appear in /usr/bin as well in some systems. That's the reason I was concerned and felt obligated to inform the OP about this.

One would be able to circumvent this by using setuid and a small c program to call shell script with only /usr/bin/ksh in it.

That would result in ksh shell with root.
Tools are gcc (not sudoed) and (sudo) chown/chmod

Excellent catch!!

But, Corona has given a solid example here. As /bin is not listed as permitted and as permit ALL is not specified, the default behavior of sudo would be to deny access. As chmod/chown appears in /bin the user will not be able to execute them with sudo. Also, user cannot copy or link chmod or chown to /usr/bin (the only permitted directory) as again cp appears in /bin directory also /usr/bin has root as the owner, so no write permission for the user. The user is trapped well.