If I run a
sudo command it will ask me for a password, however in that Terminal session for the next few minutes it will allow me to run
sudo commands without asking me for a password as it will cache that I am allowed.
This is good for convenience, and I find it rather convenient so I don't want to fix this by meaning it asks for a password every time instead of caching.
But what I have recently found has been something rather worrying, if I create a little script like this for instance:
#!/bin/bash sudo rm -rf /
And I execute it as the normal user in Terminal before I have executed any
sudo commands then all is well and works as expected, it prompts me for the
sudo password. However if I am to run a
sudo command before executing this script without
sudo it will cache that
sudo commands should not ask for a password for a few minutes in this session and then even though I did not give the script
sudo privileges it will not prompt me for a password and the script will be allowed to execute whatever
sudo commands it wants.
Now I'm not the sort to execute many scripts without knowing what's in them but sometimes I have to install stuff from a script which I got from a trusted location, but I don't know for sure if there isn't anything bad in the script so I would like the piece of mind that it's not going to just hijack the
sudo ability that has been granted to my Terminal session.
So my questions is, is it possible to make it so that I can run
sudo commands and it will cache it for me, but then if I run a script not with
sudo for the script not to be able to just hijack that ability? I understand that me executing the script is basically the same as me just executing the commands in the script in the order they are in there, but is there not a way of doing something clever so that it runs in a slightly different way or so that
sudo is restricted for scripts that I run?
Really anything though that I didn't run with
sudo shouldn't be able to run things with
sudo. Including commands. If they are only hijacking the cached ability that is...
I am running Ubuntu GNOME 15.10 with GNOME 3.18.
I have a suggestion for how this could be done but I don't know the practicalities of this: could I make it so that when I execute a command and it starts running it it logs that to a file (like is done with all Terminal commands though maybe a bit too late for this - with the
history command) and then when
sudo is run it checks if I executed that command in Terminal (through the use of the log that logs when I do) and if not then it is assumed that it's not by me so it prompts me for a password?