[SOLVED] sudoers working differently?

[oshunluvr]

I'm heavy command line user including updating my system. It seems sudoers is working differently from 24.04. Here's the setup on both installs:

• In /etc/sudoers.d/ is a file named "apt"
• It contains: "stuart office=(root) NOPASSWD: /usr/sbin/apt-get,/usr/sbin/apt,/usr/bin/add-apt-repository,/usr/bin/apt-add-repository,/usr/sbin/apt-overlay"
• In ~/,bash_aliases is: "alias update='sudo apt update; sudo apt list --upgradable'"

In 24.04, the net effect is I open a terminal and type "update". No password is required. The output is: apt is updated and a list of the updatable packages is shown.

EXACTLY the same setup using 26.04 requires my sudo password. The behavior is the same whether or not I use the alias. In other words "apt update" also promptes for a password

There are several other entires for other commands that behave the same way: no password required on 24.04 but it is on 26.04.

I'm thinking this is a bug, but wondering if anyone else has noticed this.

[Snowhog]

Well, on my 24.04 system, apt is in /usr/bin not /usr/sbin. I don't have 26.06, so I can't check that, but I'd suggest you look at your /usr/sbin directory to verify that apt and apt-get are actually there.

[oshunluvr]

stuart@office:~$ locate apt |grep sbin
/usr/sbin/apt
/usr/sbin/apt-get
/usr/sbin/apt-overlay

Turns out the "sbin" file are symlinks to sbin/apt-overlay.

[claydoh]

It is sudo-rs providing this, I think, since 25.10. I have both here, but mine is an upgrade from 24.04.
but both old and new are included in 26.04

Anyway, you might need to look at the docs for that, there are some differences in sudoers , as well as possibly needing to use pam for some things, or rather more complex things. But looking at the sudoers manpage, it should work -- though is it really /usr/sbin/apt-get, etc?

It doesn't work for me, using examples from the manpage.

But you can switch to the 'old' sudo

But I dunno. I noticed that Discover does not ask for a password when updating, so maybe whatever allows this can be used for this purpose as well?

[oshunluvr]

You might be onto to something Clay. I forgot that they had made changes to how sudo works. I'll look into that.

As far as "bin/apt" vs. "sbin/apt" it's been working that way for many years so I doubt that's the issue, especially when I'm seeing the same thing with other similarly configured commands as I stated above. On the other hand, "sbin/apt" doesn't exist in Kubuntu 26.04 so I'll need to fix that probably anyway. I did say I was using 24.04 but actually Neon. but apt and the like are not differently installed AFAIK.

Odd though, that the apt command runs the way it's configured, just requires a password - which is the main issue really.

[oshunluvr]

Just found this:

The traditional sudo binary has a decades-long history of critical CVEs caused by C memory safety issues: heap overflows, privilege escalation via environment variable manipulation, and corruption bugs. sudo-rs is a drop-in replacement that maintains full configuration compatibility with your existing /etc/sudoers file, but eliminates these vulnerability classes architecturally..

[Snowhog]

IT'S FOSS article: https://itsfoss.com/sudo-vs-sudo-rs/

[oshunluvr]

So I changed "sbin" to bin and now it works. The "sbin" files weren't in 26.04 so it seems that was the issue there.

Bot sure why "btrfs" isn't wotking tho. Looking into that now.

[claydoh]

Actually on neon, the way they prevented the use of apt /apt-get upgrade and provide a message was to move the binaries , and replace them with scripts in the standard locations, or something along those lines. I am afk and can't verify. But I did forget about this.

[oshunluvr]

So basically, it's solved. Once I went through the sudoers.d files and corrected a few things, they all work propbely now.

Thanks guys!