Write sudo rules with least privilege

Description

Good sudo rules grant precise commands to a dedicated group:

• administrators are members of a group dedicated to sudo, and rules name that group;
• commands run as an unprivileged target user whenever root is not needed ((appuser));
• rules list full command paths with their arguments, and no negations (!), since negations are easy to bypass by copying or renaming the binary;
• programs that can start other programs (editors, pagers, interpreters) get NOEXEC, or are replaced by sudoedit for editing files.

Ubuntu's /etc/sudoers gives full rights to the sudo group and to the legacy admin group, which does not exist on new installations; remove that line if nothing uses it. sudo-rs, the sudo of Ubuntu 26.04, supports NOEXEC: (enforced with seccomp) and sudoedit, and only accepts * as a standalone last argument meaning "any further arguments".

Rationale

Many programs can spawn a shell: an editor launched as root, less, find -exec, or a scripting language. A rule that allows them is effectively ALL. Negated rules and wildcards look restrictive but are bypassed with a renamed copy or an extra argument.

Impact

Rewriting broad rules takes an inventory of what each administrator really needs. Users who edit files as root switch to sudoedit.

Applies when

Detected: when: A sudo command is installed (sudo or sudo-rs) A scanner reports the control not applicable when one is false.

Audit

Read every rule with sudo -ll -U <user> for each member of an administrative group, and /etc/sudoers plus /etc/sudoers.d/. Check that:

1. rules target a dedicated group (%group), not individual users;
2. no command list contains ! (negation);
3. commands are given with absolute paths and explicit arguments, without bare *;
4. editors, pagers and interpreters are not allowed, or carry NOEXEC:; file edits use sudoedit;
5. commands that do not need root run as a dedicated user.

Remediation

1. Create a group per administrative role and use %group in rules.
2. Replace ALL and negated lists with explicit commands and arguments.
3. Replace vi /etc/file style rules with sudoedit /etc/file, and add NOEXEC: to rules for programs that can run other programs.
4. Validate with visudo -c before closing the root session used for the change.

References

• sudoers(5), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R38 to R44) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle