Sudo rules and delegated program capabilities

Mechanism

A sudo rule delegates a particular execution context, not merely a binary name. Arguments, environment handling, working directory, file writes, plugins, and child-process behavior determine the resulting authority. A program intended as a viewer or editor can have additional capabilities that matter when run with elevated identity.

Practical method

Read the permitted command and argument constraints using sudo policy output. Check the executable and any configuration it reads. Enumerate interactive escapes, output paths, and environment-controlled helpers in a local fixture. Consult GTFOBins for capability leads, then verify the exact installed version and rule.

sudo -l
command -v permitted-tool
ls -l /path/to/permitted-tool

Interpreting evidence

The relevant evidence is a behavior permitted by the exact delegation rule. A capability listed in a public catalogue does not guarantee the required arguments or environment survive policy checks.

Pitfalls and limits

Wildcards can match more than expected. Secure-path and environment-reset rules alter execution. Digest restrictions or wrapper scripts may constrain the behavior that a generic binary entry describes.