主题： sudo
-
Sudo policy as drop-in files in /etc/sudoers.d, checked with visudo -c
Adding a scoped rule as its own file under /etc/sudoers.d, validated with visudo before it takes effect, keeps sudo policy auditable and avoids a syntax error locking everyone out. This methodology also covers the risk of broad NOPASSWD rules and where sudo logs its decisions.
-
Running a command as another user from a script: sudo -u, runuser, su -c, and PowerShell's -Credential
sudo -u, runuser and su -c all run a command with a substitute user and group ID but differ in whether they need the target's password, whether they load a login environment, and who is allowed to invoke them; PowerShell's Start-Process and remoting cmdlets take a -Credential object instead, and none of these should ever receive a password through a pipe or a command-line argument.
-
Privilege elevation compared: sudo, doas, UAC, runas and AIX RBAC — and how to detect it
sudo, doas, Windows UAC and macOS's admin group all answer the same question — is this session allowed to act as an administrator — with different mechanisms and different ways for a script to check the answer before attempting a privileged action.
机器可读： JSON