Question about the less command

[ryand85]

Hi,

I've been told that making "less" accessible through sudo is considered a security risk, anyone know why that would be?

[anomie]

I would ask for clarification from the person who made that comment, because it doesn't really make sense.

The less program should be available to everyone anyway. (No sudo required for operation.)

[anomie]

I was re-reading some of my old subscribed threads and came across this.

I think I see what you're asking now. The problem with giving a sudoer access to the less program is that person could run a shell command using it. So you might think you're giving someone access only to less, but in effect you're giving a full root shell.

From the COMMANDS section of the less manpages:

! shell-command
...Invokes a shell to run the shell-command given....

Pretty nasty little gotcha.

[Franklin52]

And that's also true for almost all editors!

Regards