Meaning of @0 in a shell script

That has nothing to do with bash or sudo. The find command is using the -exec action to run the given command on each file found. In this case, the command being run is

touch -d @0

If you check man touch on a GNU system, you will find that

   -d, --date=STRING
          parse STRING and use it instead of current time

So, the -d is a way of choosing the date you want touch to set for the target file. The @ tells the GNU implementation of touch that this is a date defined as seconds since the epoch. Since it is actually 0 seconds, this means the very beginning of UNIX time. An easy way to check this is to give the same date to the GNU date command:

$ TZ=UTC date -d @0
Thu Jan  1 00:00:00 UTC 1970

So, the command you showed will find all files and directories in /var/lib/sudo and set their last modified date to 00:00 UTC on Thursday January first, 1970.

---

The reason that line exists was nicely explained in the comments below:

@crisron The purpose of the line is to ensure that all sudo passwords from any previous instance of sudo are expired. The first time a user runs sudo, for each session it'll create a file in that directory. Sudo then checks the time stamp on the file the next time you run it to decide whether or not to ask you for the password again. This line ensures that when the sudo daemon is restarted all passwords must be retyped the next time a user sudos something. – krowe

@0 is the epoch date. And more generally @x is x seconds after the epoch. For instance:

$ touch -d @0 foo
$ TZ=UTC0 ls -l foo
-rw-r--r-- 1 vinc17 vinc17 0 1970-01-01 00:00:00 foo

Note: The -d option of the touch utility is specified by POSIX but only with strings in ISO8601 forms. Other forms of strings are specific to each implementation, and in particular, the @x form is a GNU extension.

That line does the following:

/var/lib/sudo defines the working directory.

-exec touch -d @0 '{}' \; is the action to perform. Let's split it into parts:

-exec precedes the actual action.

touch -d changes file timestamps parsing the argument string and using it instead of current time.

@0 is a timestamp that is equivalent to:

root@debian:/var/log# date -d @0
Wed Dec 31 21:00:00 ART 1969

So bottom line is:

When the find command finds a hit, update the timestamp to Wed Dec 31 21:00:00 ART 1969.