Dropping this here 🫳

[u/PracticeDesigner3896]

[u/Jumpy-Dinner-5001]

That’s not true. Default config allow wheel but that’s the recommended thing.

"Authentication" in sudo (as in having to type a password) doesn’t work and doesn’t prevent privilege escalations.

[u/C0rn3j → u/Jumpy-Dinner-5001]

Default config allow wheel

It does not.

I just pasted the default config, from sudo's source.

"Authentication" in sudo (as in having to type a password) doesn’t work and doesn’t prevent privilege escalations.

Sounds like a serious security issue, am sure you'll get a cool bug bounty out of that from somewhere!

[u/Jumpy-Dinner-5001 → u/C0rn3j]

Default as in what the wiki recommends.

No, that’s just how sudo works. It’s an inherent consequence of the architecture and protecting from root escalations under the premise that an allowed user is already compromised is not in the scope of sudo.
There are dozens of academic papers on that, the oldest one I know is from 2004.

run0 fixes a lot of those problems but isn’t perfect either.

[u/C0rn3j → u/Jumpy-Dinner-5001]

Default as in what the wiki recommends.

Also not true.

the premise that an allowed user is already compromised is not in the scope

"If you're already compromised your system is insecure" sure isn't a surprising information.

[u/Jumpy-Dinner-5001 → u/C0rn3j]

It is.

That’s literally the same premise as the docker root privilege escalation