Strange issue with sudo after update 2024-10-10

Support System Updates
1

I’m finding an odd problem with sudo since this update.
my ~/.zshrc for both my user and root extend the $PATH variable so it’s easy to run my locally-written scripts in ~/bin. But since updating, sudo no longer finds scripts in my ~/bin directory.

Running sudo echo $PATH returns the PATH as I would expect it, but
sudo env | grep PATH only returns /usr/local/sbin:/usr/local/bin:/usr/bin, so it appears that sudo is neither preserving my user’s $PATH nor picking up $PATH from /root/.zshrc

Running sudo konsole or sudo xterm and then trying to run a command in my ~/bin directory works, so somehow that’s picking up the .zshrc.

I’ve tried downgrading sudo (as that was updated in this upgrade) but this made no difference (even tried rebooting in case that made a difference). I’m now stumped.

2

OK, I’ve solved this. In /etc/sudoers, Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/bin" was uncommented. It hadn’t been beforehand. Though I’m not sure why that didn’t get restored to its original state when I downgraded sudo.

3

TIP:

Instead of editing that file directly, do any customisations in their own file in the /etc/sudoers.d drop-in directory:

$ sudo ls -lAh /etc/sudoers.d
total 12K
-r--r----- 1 root root  21 Sep 14  2020 10-installer
-r--r----- 1 root root  67 Jan 15  2023 manjaro-update-helper
-rw-r--r-- 1 root root 491 Aug 17 13:38 mirdarthos

They use the same syntax as /etc/sudoers.

1 Like
4

I normally do this. As far as I can make out, /etc/sudoers had that line commented out from when it was installed, and got changed by the upgrade. Though I’m not sure that commenting it out in a sudoers.d file would have the effect of overriding the uncommented line in /etc/sudoers. (Though I suppose setting the path in there would do it).

5

Good man.

:man_shrugging:

But, I’ve never had such a problem since doing the drop-ins…

:man_shrugging:

6

My second guess was right. Setting the path in a sudoers.d file allowed it to be set correctly. Got there in the end .

1 Like
7

Don’t do this. This is security relevant, and together with path and alias, (which have some internal protection) can lead to privilege escalation. It is good someone finally decided to correct the default setting.

It is not a big deal to type ./ in front of your custom script.

3 Likes
8

Perhaps a .pacnew file wasn’t merged correctly (wild guess); I seem to recall there was a sudoers.pacnew sometime in the last year.

incidentally, the line in question is not commented in my sudoers (I don’t know if it ever was).

9

Same.

:man_shrugging:

10

Strange. I was convinced I’d never edited the file (which is why I just accepted the pacnew). Perhaps the whole thing was self-inflicted…

11

Seems that way:

$ sudo grep -i secure /etc/sudoers                                                                                                                                                                                             [sudo] password for mirdarthos:
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/bin"
12

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.