In all current versions of 10.10 (up to and including 10.10.4), there is a rather nasty security hole which allows any process to create files owned by root anywhere on the file system. One example involves the creation of a "new" sudoers file allowing for elevated permissions by any account.
Details about the bug can be found at this link
There is a kernel extension which purportedly eliminates this vulnerability, but, I'm wondering if there is any other method of defense which even a locally escalated root user cannot circumvent.
For example, root cannot delete some Time Machine backup files directly; so, there is some flag which may be able to be applied to
sudoers? And, I think that managed clients via workgroup manager or profile manager can sometimes keep even root from changing files. Is there a payload that can accomplish this?
The beta version of 10.11 El Capitan is not affected by this vulnerability, so it seems likely that Apple will release a patch to 10.10 soon.