Linux Elevation Control

Linux Elevation Control

1. Sudo commands allow the user to execute an action as a superuser. When a user performs this action in a Linux terminal, ThreatLocker logs it in the Unified Audit as an ‘Elevate’ Action Type. 
   
   
   
2. On a Windows machine, the ‘Elevate’ action type would signify a user gaining elevated privileges, but Linux machines do not operate the same way. Instead, if a Linux machine displays the ‘Elevate’ action type, it is to inform you through the Unified Audit that a user has run the sudo command. Additionally, it prevents the user from continuously typing the sudo password when running a sudo command. 
3. This feature only works with file paths and does not work with hashes. 

Example
Creation of a policy to elevate ls:

Setting up an application definition to elevate ls

sudo -k removes any sudo cache.

Here, you can see sudo ls is ran and no password prompt is required.