[SOLVED] KDEneon sudoers.d files not working again

[oshunluvr]

This appears to be a regression.

Previous thread and bug report:
https://www.kubuntuforums.net/showth...hlight=sudoers
https://bugs.launchpad.net/ubuntu/+s...e/+bug/1584549

Sometime in the last month, some update or another caused the files in sudoers.d to not be honored yet again. I've tried different formats in the files to see if the syntax changed Nothing has worked and ALL of them are being ignored. I suspect the functionality no longer works or the formatting has changed dramatically and recently.

Here's the info in case anyone wants to look into it to verify what I'm experiencing;

All files under /etc/sudoers.d/ are permissions 0440 and root owned.
visudo -c confirms the syntax passes the checks.

I have tried the following formats. All of these passed syntax check and the first one is what worked beginning in 16.04 when the functionality first stopped working properly (see bug report above):

stuart office.smith.lan = (root) NOPASSWD: /usr/bin/apt-get,/usr/bin/apt,/usr/bin/add-apt-repository,/usr/bin/apt-add-repository

stuart office.smith.lan = (root) NOPASSWD: /usr/bin/apt-get
stuart office.smith.lan = (root) NOPASSWD: /usr/bin/apt
stuart office.smith.lan = (root) NOPASSWD: /usr/bin/add-apt-repository
stuart office.smith.lan = (root) NOPASSWD: /usr/bin/apt-add-repository

stuart office = (root) NOPASSWD: /usr/bin/apt-get,/usr/bin/apt,/usr/bin/add-apt-repository,/usr/bin/apt-add-repository

stuart ALL = (root) NOPASSWD: /usr/bin/apt-get,/usr/bin/apt,/usr/bin/add-apt-repository,/usr/bin/apt-add-repository

ALL ALL= (root) NOPASSWD: /usr/bin/apt-get,/usr/bin/apt,/usr/bin/add-apt-repository,/usr/bin/apt-add-repository

None of these work. not even the last one which is the least restrictive. Prior to 16.04, #3 above worked. I reported the bug after 16.04 came out that required the Fully Qualified Domain Name (#1 above) instead of the shortened hostname that occurred at the 16.04 release, but no one ever responded. I'd like to know if the syntax changed or if it works normally for anyone else before I report it as a bug.

[Snowhog]

I'll check when I'm back at the house (out having my morning coffee at the moment). I don't have 18.04 installed, but I do have 18.10, and have my own file in /etc/sudoers.d. Or is this specific to 18.04?

[oshunluvr]

I'll check when I'm back at the house (out having my morning coffee at the moment). I don't have 18.04 installed, but I do have 18.10, and have my own file in /etc/sudoers.d. Or is this specific to 18.04?

I don't know as haven't installed 18.10 anywhere. Be interesting to know if it works in 18.10 and above.

[Snowhog]

Anything here useful?

[oshunluvr]

OK, I installed a fresh KDEneon LTS Useredition in a VM and sudoers is not working. BUT I also installed a fresh Kubuntu 19.04 and the same exact file in sudoers.d WORKED. So whatever is bug or problem is, it's either fixed upstream or solely a KDEneon problem.

I haven't tried Kubuntu 18.04 yet nor KDEneon Unstable.

[Snowhog]

I haven't tried Kubuntu 18.04 yet nor KDEneon Unstable.

But you posted this in 18.04. I'm confused.

Just fired up my KDE neon User Edition 5.15 (based on Ubuntu 18.04) the content of /etc/sudoers.d/ is working; I have one file there named paul which contains:

paul barley-cat = (root) NOPASSWD: /usr/bin/apt,/usr/bin/apt-get,/usr/bin/add-apt-repository,/usr/bin/apt-add-repository,/usr/bin/ucaresystem-core

Permissions and ownership on /etc/sudoers.d is drwxr-xr-x root root

Permissions on /etc/sudoers.d/paul is -r--r----- root root

[oshunluvr]

I'm using KDEneon 18.04 not Kubuntu 18.04. I generally only post in the KDEneon section when I know it's related specifically to KDEneon and not generally an Ubuntu 18.04 problem - which both KDEneon and Kubuntu are based on. Since this issue is not a Desktop Environment issue, I surmised it was more likely related to Ubuntu packages as those are identical across both Kubuntu and KDEneon.

It may in fact be an issue with my install and not specific to the KDE packages at all, but my initial VM test shows a fresh KDEneon responding identically to my install. It is very curious that your KDEneon 18.04 works where my brand-new untouched (but updated) KDEneon does not.

Obviously more digging is required.

[oshunluvr]

Paul, what sudo package is on your system? @here it's 1.8.21p2-3ubuntu1

[Snowhog]

sudo --version

Sudo version 1.8.21p2
Sudoers policy plugin version 1.8.21p2
Sudoers file grammer version 46
Sudoers I/O plugin version 1.8.21p2

apt-cache policy sudo

Installed: 1.8.21p2-3ubuntu1
Candidate: 1.8.21p2-3ubuntu1

[oshunluvr]

Kubuntu 18.04.2 does not have the error. Seems related to KDEneon only.

moving thread...

[oshunluvr]

Both versions of Kubuntu (18.04 and 19.04) this /etc/sudoers.d/apt works:

stuart ALL = (root) NOPASSWD: /usr/bin/apt-get, /usr/bin/apt

but the exact same entry in KDEneon 18.04 does not.

[Snowhog]

in KDEneon, what is in your sudoers file? sudo visudo

[oshunluvr]

It's not the sudoers file - they all match.

I've determined it's definitely a missing package - undeclared dependency or something like that. Here's what I did this morning:

Test installs: 18.04.2 Kubuntu along side KDEneon LTS latest - both have an Ubuntu 18.04 base.
Created identical /etc/sudoers.d/apt files in both installs (as noted above).

Results: No password required for Kubuntu but still required for Neon.

Then I dumped dpkg file lists from both installs, trimmed it to just a list of package names, then extracted a list of packages that were installed to Kubuntu but not Neon. I removed libreoffice and kernel packages from the list, then installed all remaining packages into Neon.

Results: Neon no longer needs a password for apt.

Conclusion: There is a package(s) that sudoers.d needs to parse the files and the default Neon install does not have it/them. Now it's just a matter of figuring out which one(s).

[Snowhog]

Conclusion: There is a package(s) that sudoers.d needs to parse the files and the default Neon install does not have it/them. No it's just a matter of figuring out which one(s).

I'm not sure I agree with that, at least, given that the KDE neon I have was a 'stock' install (not recently, but it was stock when it was installed), and when I created my file in /etc/sudoers.d (per your post), it worked, and still works, as it should.

I'm not at the house; having my morning coffee at my local coffee shop; but when I get back, I'll run a reverse depends on sudo and post the results. You can compare it to yours.

[oshunluvr]

Well, agree or not I just again created a new KDEneon VM and the sudoers files I'm using on Kubuntu does not work. Try it yourself.

This exact file on both fresh install of Kubuntu 18;04 and KDEneon: /etc/sudoers.d/apt

stuart ALL = (root) NOPASSWD: /ust/bin/apt

Kubuntu:


Neon: