Can a sudo user read the command file for which sudo access is enabled?

Question

I have a normal Linux user say user1, and it has sudo access to a command /usr/local/bin/command.sh.

/usr/local/bin/command.sh has 700 permission. So therefore the user1 is successfully able to run

sudo /usr/local/bin/command.sh

Now I was wondering that with sudo command the privilege escalation is happening. is there any possibility or even a remote possibility that he can read the contents of /usr/local/bin/command.sh? Is sudo by design a very strict command based implementation?

Answer 1

The one word answer is: No.

(…) So therefore the user1 is successfully able to run (…)

Strictly speaking it is not user1 who is running that executable, but the user switched to using sudo (in your case root), who of course can also read that file. Now if there's a vulnerability in the executable executable run via sudo, you could piggyback on that to read an arbitrary. file, but that would be bad .