I have a company MacBook Pro. I am sudoer and I can do anything that requires admin privileges when I'm connected to the company network. But I can't when I'm home. How is that possible?
This special behavior is probably related to the sudoers file.
By modifying this file in /private/etc/ one can restrict the sudoers to particular networks or single IP-addresses:
The common user privileges specs are as following:
# User privilege specification root ALL=(ALL) ALL %admin ALL=(ALL) ALL | | |command | |as user | hosts
This means: the users of the group admin can sudo any command as any user ("Runas") from all networks.
By specifying a restricted host/network in the host alias specification earlier in the same file this may be changed:
# Host alias specification Host_Alias COMPNET = 172.17.0.0/255.255.0.0
Modifying the user privilege specifications to:
root ALL=(ALL) ALL %admin COMPNET=(ALL) ALL
doesn't allow you to execute sudo in your home network if the IP-address is not in the above range (e.g. your home network provides DHCP leases in the 192.168.0.0/24 range and none of the other interfaces have an IP in the above 172.17.0.0/255.255.0.0 network). Back in the company network (e.g. with a DHCP range 172.17.5.0/24) sudoing works again.