A digest in a sudoers rule can answer a narrow question: did the command file have the expected bytes when sudo checked it? It does not prove that the path is controlled by an administrator, that the file will remain unchanged until execution, or that the command's dependencies are equally trustworthy.

Sudo supports SHA-2 digest lists on command entries. An operator can pin a script or binary to a known hash and reject an unexpected replacement. That is useful for controlled deployment, but the sudo manual includes an important warning. If the user can write the command or its parent directory, the file may be replaced after the digest check and before execution. Systems without a suitable fexecve(2) path can have a related race.

What the digest proves

This warning changes the review method. Start with file ownership and directory permissions, not the hash value. Trace every directory in the command path and ask whether the invoking user, a service account, or an application process can create, rename, or replace an entry. A hash on a script in a writable directory is not a stable privilege boundary.

Ownership and execution race

Next, inspect interpreters and helpers. A script digest covers the script text, not the Python interpreter, shell, configuration file, plugin directory, or command it invokes. A pinned wrapper can still execute an unpinned program through a relative path or a user-controlled configuration variable. secure_path and env_reset may reduce that risk, but they do not turn a writeable dependency into a trusted one.

Review checklist

Operationally useful controls include:

  • Place privileged commands in administrator-owned directories that ordinary users cannot modify.

  • Keep scripts and their configuration files under the same ownership and deployment policy.

  • Avoid wildcard rules that let the caller choose arbitrary interpreted files.

  • Record the digest algorithm, source package, deployment time, and update owner.

  • Re-test the rule after package upgrades and emergency patching.

Change control

Digests also need an update process. If the only copy of the expected hash lives in someone's notes, an upgrade creates either an outage or an undocumented exception. Store the approved value in configuration management, generate it from a signed artifact, and require a review when it changes. The digest is evidence of file identity, not a substitute for artifact provenance.

Finally, check how sudo resolves the command at runtime. Absolute paths are easier to reason about than names looked up through PATH. A directory that is safe today can become unsafe after a permissions change or a new group membership. The review should therefore connect the sudoers entry to the filesystem, deployment pipeline, and application execution path.

Sudo command digests are useful when they close a specific integrity gap in an already controlled path. They are misleading when used to make a user-writable executable look approved. Treat the file, its parent directories, interpreter, dependencies, and update process as one trust decision.

References

  • sudoers manual, command digests and replacement warning: https://man7.org/linux/man-pages/man5/sudoers.5.html