2

We recently upgraded our aws linux server instance type. It is still an SLES 12 SP1. However I am noticing some differences some of which are confounding

$ sudo -u xyz cmd ...
<it asks for password, causing old scripts to break>

$ sudo -u xyz /path/to/cmd ...
<works>

$ sudo --version
Sudo version 1.8.10p3
Sudoers policy plugin version 1.8.10p3
Sudoers file grammar version 43
Sudoers I/O plugin version 1.8.10p3

$ uname -a
Linux ovcp6hana1 3.12.69-60.64.32-default #1 SMP Wed Feb 15 08:57:04 UTC 2017 (76392c8) x86_64 x86_64 x86_64 GNU/Linux

(The sudoers config has a Cmnd_Alias and authorization for "/path/to/cmd")

The former version used to work but it does not, as if the path was being automatically expanded earlier but not any more.

Is there some way to get the old form to work? Thanks.

--EDIT

I verified that it is the exact same command, ie which xyz expands to /path/to/xyz.

--EDIT 2

I think I found the issue, but still don't have a way to stay compatible with my application. It appears the difference is between sudo versions 1.7.6 and 1.8.10. But I failed to find such a mention in the sudo release notes

I created another user with similar privileges on an older server running sudo 1.7. The specific privilege is as below. The config files in the two match in options

#added in /etc/sudoers
#userA ALL=(userABC) NOPASSWD: /bin/bash, /usr/local/bin/aws

#with both sudo versions
userA$ sudo -u userABC bash -c "echo \$PATH"
/usr/bin:/bin:/usr/sbin:/sbin

userA$ sudo -u userABC bash -c "which aws"
/usr/bin/aws <<<< but this is not reached in either of the two cases

userA$ which aws
/usr/local/bin/aws <<<<<< this is the right binary

#with sudo version 1.7.6
userA$ sudo -u userABC aws
..the right binary runs, so path must have been set between check and run

#with sudo version 1.8.10
userA$ sudo -u userABC aws
failure! sudo asks for password of userABC

The program /usr/bin/aws does some kind of wrapping. Until now I was blissfully unaware (!) of its existence but even when I momentarily removed this program, there was no impact on anything.

So I have a slightly better understanding of the problem but still don't know if there is an option other than changing the app.

1

When a user is permitted to execute a command as another user by a rule in the sudoers file that specifies a full path to an executable, then this full path needs to be used on the command line as well.

This is a security measure.

Additionally, if the command in the sudoers file is specified with command line flags, those flags need to be present when you invoke the command through sudo.

| improve this answer | |
  • I justed edited my question with more details. So pathless worked with sudo 1.7 but not in sudo 1.8 - maybe it's time to make the change – Dinesh Mar 21 '17 at 23:04
1

This is happening because your sudoers file is allowing a NOPASSWD attribute to apply when invoking the explicit path to the executable, but not when you rely on path searching; it may be hitting a different executable.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.