Back to problem
Systems Administrator ICoreSudo Policy~35-45 min

The Intern Has Too Much Sudo

The intern only needs to check and restart one service. Why can they run anything as root?

Your goal

Your goal is not simply to make the scary word ALL disappear from a sudoers file. Your goal is to learn how an administrator reads a real support requirement, inspects the privileges someone already has, translates "check and restart report-api" into an exact, minimal sudo rule, validates that rule safely before it goes live, and then — the step most people skip — actively attacks their own policy with negative tests to prove that everything unrelated is still denied.

Delegate
Inspect
Design
Validate
Attack

An intern was granted sudo access to help operate report-api, but the grant on the box today allows unrestricted, passwordless root — not the two narrow actions the job actually requires.

01

root can open every door. That's exactly why you don't hand out the key.

Linux has one privileged administrative account: root, conventionally UID 0. Root can do things ordinary accounts can't:

  • Modify protected system configuration
  • Manage services
  • Change ownership of anything
  • Manage other accounts
  • Read protected files

Deciding who gets that power is one of the biggest security decisions an administrator makes. The naive fix — just hand the intern the root password — breaks down fast:

  • The moment several people share one set of root credentials, you lose the ability to answer basic questions
  • Who actually ran that command?
  • What were they supposed to be allowed to do?
  • Could any of them have done literally anything on the box?
shared root password
Alice, Bob, and the intern are indistinguishable once logged in as root
vs
delegated, scoped access
Alice: broad admin. Intern: restart report-api, view its status. Nothing else.
DELEGATION

sudo exists so a small, audited slice of root's power can be delegated to a specific person for a specific purpose:

  • It delegates without ever handing over the root password itself
  • Every approved command is logged
  • It's a policy tool first, and a "become root" shortcut a distant second
  • More precisely: sudo evaluates a policy, and if that policy allows it, executes one particular command as another identity
  • It isn't "become root" — it's "run this one thing as root, because policy says you may"
intern asks sudo
wants to run one command
sudo policy
is intern allowed? as whom? which command? under what conditions?
run the command
only if policy says yes — nothing broader
Knowledge check 0

Someone suggests just giving the intern the root password so they can restart report-api whenever it's needed.

What's the real problem with that, beyond it being "more access than needed"?