I had corrupted my sudo setup. With no possibility to login as root (locked root account, broken sudo), a search made it clear: use pkexec. It worked. So far, so good.
But that turns out to be a big security hole: a user that is part of the 'sudo' group can always gain root access, and start a shell as the root user. That is, at least on a default Ubuntu server installation with sudo.
This renders sudo useless as a means to restrict elevated privileges to certain commands for selected users. Unless some policykit policy is altered, apparently. That's not mentioned in the man pages of 'visudo' or 'sudo'. And I've never seen it mentioned in any tutorial on how to set up the sudoers file (probably I've been reading the wrong tutorials, then).
Can anyone point me into the right direction? What policykit, or sudo, configuration file needs to be changed (and how) in order to accommodate privilege escalation for one specific command, for one specific user?
As an example, I want the 'sudotest' user to only be able to run the command 'cat /proc/tty/driver/serial' which results in a 'Permission denied' error for non-privileged users.
Setup:
- Ubuntu bionic
- user 'sudotest', part of 'sudo' group
- either: single sudo command for 'sudotest', or even none
me@some-server:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 18.04.2 LTS
Release: 18.04
Codename: bionic
me@some-server:~$ ls -l /home
total 20
drwx------ 6 me me 4096 May 17 15:17 me
drwx------ 2 root root 16384 Nov 26 17:20 lost+found
me@some-server:~$ sudo cat /etc/sudoers | grep -v "^#\|^$"
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
root ALL=(ALL:ALL) ALL
me ALL=(ALL:ALL) ALL
%admin ALL=(ALL) ALL
me@some-server:~$ sudo useradd -m -d /home/sudotest -s /bin/bash sudotest
me@some-server:~$ sudo gpasswd -a sudotest sudo
Adding user sudotest to group sudo
me@some-server:~$ sudo passwd sudotest
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
me@some-server:~$ su - sudotest
su - sudotest
Password:
me@some-server:~$ $ groups
sudotest sudo
sudotest@some-server:~$ sudo -l
[sudo] password for sudotest:
Sorry, user sudotest may not run sudo on some-server.
Hey, this user can not even do anything with sudo. Looks like an unprivileged user. Still, this user is perfectly capable of gaining a root shell using pkexec.
How can I prevent this? What configuration options do I have to allow this user to execute one single command of my choosing with elevated privileges?
Update: This is different from the linked question in that I want to know how I can (safely) limit a specific user to be able to execute one specific command with elevated privileges with sudo on a system that has polkit installed by default, which, apparently, allows any sudo user to gain a root shell.