A comment on this answer states:
The whole linux desktop provides very little protection against bad processes running as the user. A bad process could just watch the keyboard input and wait for the user to run a command as sudo. The bad process now has root without ever being known to the user.
Frankly, this scares me - I was under the impression that
sudo <command> would only give elevated permissions to run that command, and this method of strict permission management was what made linux much more secure than Windows. I didn't think that
sudo could be "intercepted".
Are "bad processes" capable of watching the keyboard to obtain root access? If so, how would a process grant itself those permissions when they are for another process? An example of a bad process that could do this along with possible countermeasures would be really appreciated.