I am concerned about the DYLD_PRINT_TO_FILE exploit in the sudoers file.
If I have my sudoers file open, what are the markers I should be looking for as a sign of infection? My sudoers file is actually quite small and too my (mostly untrained) eye, I don't see anything that would be a concern. But what are some examples of lines/variables that would indicate a problem?
Here's is the bottom half of my file, nothing there jumps out at me. Thoughts?
# User privilege specification root ALL=(ALL) ALL %admin ALL=(ALL) ALL # Uncomment to allow people in group wheel to run all commands # %wheel ALL=(ALL) ALL # Same thing without a password # %wheel ALL=(ALL) NOPASSWD: ALL # Samples # %users ALL=/sbin/mount /cdrom,/sbin/umount /cdrom # %users localhost=/sbin/shutdown -h now