About sudo commands with critical binaries on macOS

Prev Next

Some binaries can be potentially harmful if allowed to run with Sudo. Some of them alter directory and file privileges, while others allow the execution of additional commands. In general, text editors also pose risks, as in many contexts they allow access to command execution.

Below is a list with recommendations of binaries that should not be configured in the environment, except in very specific situations, or preferably, not even then:

/bin/chown
/usr/local/bin/
/bin/nano
/usr/bin/passwd
/usr/sbin/groupadd
/usr/sbin/groupmod
/bin/chmod
/usr/bin/chgrp
/bin/bash
/usr/bin/pkill
/usr/sbin/visudo
/usr/bin/sudo
/usr/bin/telnet
/usr/bin/ftp
/usr/bin/wget
/usr/bin/curl
/usr/bin/netcat
/usr/bin/nc
/usr/bin/ruby
/usr/bin/vi
/usr/bin/open
/usr/bin/find
/usr/bin/less
/usr/bin/more