> Seems to me that fixing the "exclude" stuff in sudo is a bit harder than just
> verifying the path is on the exclude list. Any exclude list should default
> automaticaly to only letting you run stuff owned by root (or bin, or whatever
> owns your system binaries) Otherwise a user can just make a copy of (or
> compile) something banned. Though realistically, I don't see how you could
> make an exclude list complete enough to avoid letting a user run a shell, at
> which point the user can do anything anyway.
excluding things from 'ALL' is pretty much meaningless for the
reasons you've noted above. The exclusion facility is really only
useful for subtractings things from a real list...
- todd