sudo -u#-1: a bug in an unusual config
A sudo bug lets some users run commands as root. It only affects one kind of rule, but check yours.
A bug in sudo (CVE-2019-14287) was disclosed yesterday. If your sudoers file lets a user run a command as any user except root, for example with (ALL, !root), that user can still get root by asking for user ID -1: sudo -u#-1 command.
Most systems don’t use that kind of rule, so most aren’t affected. But it shows why “everyone except root” rules are risky.
What to do:
- Update sudo to 1.8.28 or your distribution’s fixed package.
- Search your sudoers files and
/etc/sudoers.d/for!root. - Prefer allowlists: grant specific commands as specific users, instead of “all except”.
Denylists in security rules tend to miss something. Allowlists fail safer.