Remove the over-broad sudo rule
A sudoers rule lets student run less as root with no password — which is really a grant of full root.
Review the rule, then remove it.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`cat /etc/sudoers.d/student-maint` shows the rule.
`sudo rm /etc/sudoers.d/student-maint` removes it; `sudo -l` confirms it is gone.
Solution explanation
The NOPASSWD: /usr/bin/less rule looked minor but was a full root grant — less can spawn a shell. Removing the drop-in file in /etc/sudoers.d/ closed it. The principle to carry forward: grant sudo for the narrowest possible command, never for a program that can run other programs, and avoid NOPASSWD unless there is a strong reason.
Show solution
cd /home/student
cat /etc/sudoers.d/student-maint
sudo rm /etc/sudoers.d/student-maint
sudo -l