Bug 448

Summary:	includedir directive in /etc/sudoers is ignored
Product:	Sudo	Reporter:	phoenix271828
Component:	Sudo	Assignee:	Todd C. Miller <Todd.Miller>
Status:	RESOLVED INVALID
Severity:	normal
Priority:	low
Version:	1.7.4
Hardware:	PC
OS:	Linux

Description phoenix271828 2010-11-05 19:38:58 MDT

MY SYSTEM
---------

This is on Fedora 13, up to date packages as of today, using SUDO v1.7.4p4.  The unname output is:

Linux schween5.schweendom 2.6.34.7-61.fc13.x86_64 #1 SMP Tue Oct 19 04:06:30 UTC 2010 x86_64 x86_64 x86_64 GNU/Linux


THE SYMPTOMS
------------

The includedirs directive in /etc/sudoers is apparently being ignored.  I tried it with and without a leading hash mark (#), and I also separated it from the immediately preceding comment by inserting a blank line in between.  The file and directory permissions are correct, AFAIK, and visudo doesn't complain.  No matter what, SUDO doesn't seem to be reading the sole file in the include directory (/etc/sudoers.d).

Seaching your bugs database didn't turn up any relevant, open bug reports, except perhaps bug #398 (because it mentioned NOPASSWD).  A Google search turned up this same problem, but in an earlier SUDO version, since fixed.

I don't know if this is a problem with SUDO itself, or if it's a problem with Fedora's SUDO package, or a problem with the user.


TO REPRODUCE
------------

1. Put this at the end of the /etc/sudoers file:

## some comment
#includedir /etc/sudoers.d

2. Put this in the /etc/sudoers.d/sudoers.local file:

rmkelly ALL = NOPASSWD: /usr/local/bin/wayback

3. Run this as a normal user:

sudo /usr/local/bin/wayback -h

4. SUDO requests a password, although it shouldn't.  Then it fails even with the correct password.  It also sends mail to root complaining about the user not being in the sudoers file.

5. Now move the line from step #2 to the end of the /etc/sudoers file, and repeat step #3.  Everything works fine.

Comment 1 Todd C. Miller 2010-11-30 12:25:35 MST

From the sudoers manual:

sudo will read each file in /etc/sudoers.d, skipping file names that end in ~ or contain a . character to avoid causing problems with package manager or editor temporary/backup files.

This is similar to how files in /etc/cron.d are handled.

Comment 2 phoenix271828 2010-11-30 23:29:33 MST

Hi, Todd.  Thanks for showing me what I was doing wrong.