back to labs
Sudo: Remediate an Over-Broad Grant
MediumLinux Security15-20 minThe brief
A security review flagged a dangerous sudoers rule: an application account has been given passwordless sudo to EVERYTHING (NOPASSWD: ALL) when it only ever needs to run one command. Read /root/case/assignment.env for the account (BADUSER) and the single command it legitimately needs (CMD). Fix the drop-in under /etc/sudoers.d/ so the account keeps NOPASSWD access to exactly that one command and nothing else — the blanket ALL privilege must be gone. Keep the sudo configuration valid. Grading reads the durable sudoers policy.
What you'll do
- Remove the account's blanket NOPASSWD: ALL privilege
- Leave it a scoped NOPASSWD grant for exactly the assigned command
- Keep the sudo configuration syntactically valid
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.