Sudo interpretation of wildcard like /var/log/messages* can indirectly expose a security risk

Solution Verified - Updated 2016-12-27T15:25:29+00:00 -

Issue

Sudo interprets wildcard arguments allows for multiple arguments rather than a single file argument.
Given the rule:

# Allow user unixro to view any of the /var/log/messages log files
unixro  ALL=NOPASSWD: /bin/cat /var/log/messages*

Running the following results in the /var/log/messages content AND the /etc/shadow content to be displayed on the terminal.

sudo /bin/cat /var/log/messages /etc/shadow

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.