[anthk]

/usr/bin/sudo isn't evaluated as a function under ksh.

[nightpool]

> And every other suggestion also doesn't work if the attacker can just replace the shell.

[anthk]

With what? rc? My only shells are sh, ksh and rc there.