Re: Permissions on NFS mounts

From	Michael Stone <mstone@debian.org>
Newsgroups	linux.debian.user
Subject	Re: Permissions on NFS mounts
Date	2020-12-10 18:30 +0100
Message-ID	<BkxVo-2fW-3@gated-at.bofh.it> (permalink)
References	(4 earlier) <BkqTU-6mH-13@gated-at.bofh.it> <Bkr3A-6Fd-7@gated-at.bofh.it> <BkrwB-6Oc-7@gated-at.bofh.it> <BkukN-8uM-7@gated-at.bofh.it> <Bkuuu-6n-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Thu, Dec 10, 2020 at 04:48:36PM +0300, Reco wrote:
>I just like to remind you the original question:
>
>Is there a way to put an account "beyond use", in any way including su,
>sudo etc,
>
>*In any way* includes the way I've described above IMO.

So you're asking if there's a way to prevent someone from using sudo to 
do something sudo has been specifically configured to do? Kind of a 
weird question, IMO. If you don't want to allow someone to sudo to a 
particular user then...don't configure sudo to allow them to do that.

Also worth pointing out that having a passwd entry isn't even relevant 
to whether root can setuid. At some point if you've provided enough rope 
then setting a bunch of artificial constraints for the sake of argument 
is just a waste of time.

# id
uid=0(root) gid=0(root) groups=0(root)
# id 1234
id: ‘1234’: no such user
# python3 -c 'import os; os.setuid(1234); os.execl("/bin/bash", "bash")'
$ id
uid=1234 gid=0(root) groups=0(root)

Thread

Permissions on NFS mounts Paul M Foster <paulf@quillandmouse.com> - 2020-12-09 21:40 +0100
  Re: Permissions on NFS mounts Dan Ritter <dsr@randomstring.org> - 2020-12-09 22:00 +0100
    Re: Permissions on NFS mounts Mark Fletcher <mark27q1@gmail.com> - 2020-12-10 10:20 +0100
      Re: Permissions on NFS mounts Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-10 10:50 +0100
        Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 11:00 +0100
          Re: Permissions on NFS mounts Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-10 11:10 +0100
            Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 11:40 +0100
              Re: Permissions on NFS mounts Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-10 14:40 +0100
                Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 14:50 +0100
                Re: Permissions on NFS mounts David Wright <deblis@lionunicorn.co.uk> - 2020-12-10 16:40 +0100
                Re: Permissions on NFS mounts Tixy <tixy@yxit.co.uk> - 2020-12-10 16:40 +0100
                Re: Permissions on NFS mounts Greg Wooledge <wooledg@eeg.ccf.org> - 2020-12-10 16:50 +0100
                Re: Permissions on NFS mounts Michael Stone <mstone@debian.org> - 2020-12-10 18:20 +0100
                Re: Permissions on NFS mounts Michael Stone <mstone@debian.org> - 2020-12-10 18:30 +0100
      Re: Permissions on NFS mounts Reco <recoverym4n@enotuniq.net> - 2020-12-10 11:00 +0100
      Re: Permissions on NFS mounts Darac Marjal <mailinglist@darac.org.uk> - 2020-12-10 13:00 +0100
  Re: Permissions on NFS mounts Michael Stone <mstone@debian.org> - 2020-12-10 18:00 +0100

csiph-web