Comment by foxhill
20 hours ago
forgive me if i’m wrong. i don’t think you’ve ever had to administer more than a handful of machines. your “fix” is irrelevant.
> That being said there definitely should be an automated way to check for incompatibilities between normal and rust sudo.
yes. it’s called the bare minimum.
I do manage more than a handful of machines, and that means using automation tools and IaC as much as possible, while avoiding humans using shells as much as possible. I’m struggling to enumerate a lot of use cases for a bespoke sudo configuration that shouldn’t be a proper setup.
If you're using `sudo` for something beyond trivial `reboot`, you're doing something VERY wrong.
If you're not in the user community of a tool, having an opinion on whether or not the replacement should work doesn't seem like it should matter to you at all.
The complexity of tools and the associated danger absolutely matters.
What are you doing wrong?
Like.... apt-get?
`sudo apt install my-custom-backdoor-script.deb`
With NOPASSWD you would also invite someone pulling a `.deb` via `curl` as part of a supply chain attack in a some non-descript NPM package via a git hook or something.
So you want users to be able to install any package? So that the attack surface is now literally all the Debian archive?
Yeah, no.
You either use `sudo` when you want full root access or for something completely trivial.
2 replies →