Bug 389

My understanding is that permission to sudoedit is granted by a line in the sudoer file like this:

   user1 ALL = sudoedit /etc/network/interfaces

This works as expected (because the string sudoedit is a special case), eg

   user1@host1:~$ sudoedit /etc/network/interfaces

However, it also appears to grant access to sudo any executable called 'sudoedit' (if the appropriate parameters are passed in). For example, a user executable in the home directory called sudoedit:

   #!/bin/sh
   whoami

can be invoked using

   user1@host1:~$ sudo ./sudoedit /etc/network/interfaces

I had expected that because sudoedit is a special case string, that it should not match anything apart from invoking /usr/bin/sudoedit.

This problem was encountered with build 1.6.9p17 of sudo on a Debian Lenny system. The issue was pointed out to me by Glenn Waller (Brisbane, Australia).