[throwaway7356]

Yeah, works well:

$ /usr/bin/sudo() { echo Not the real sudo.; }

$ /usr/bin/sudo

Not the real sudo.

And every other suggestion also doesn't work if the attacker can just replace the shell.

[anthk]

/usr/bin/sudo isn't evaluated as a function under ksh.

[nightpool]

> And every other suggestion also doesn't work if the attacker can just replace the shell.

[anthk]

With what? rc? My only shells are sh, ksh and rc there.