Bug 981

Summary:	sudo didn't ask for my password
Product:	Sudo	Reporter:	Paul Pinterits <rawing7>
Component:	Sudo	Assignee:	Todd C. Miller <Todd.Miller>
Status:	ASSIGNED ---
Severity:	security
Priority:	low
Version:	1.9.7
Hardware:	PC
OS:	Linux

Description Paul Pinterits 2021-07-10 11:54:49 MDT

This is probably gonna be hard to believe, but I figured it's worth reporting anyhow.


=== The bug ===

After cancelling a `sudo` with a keyboard interrupt, the next invocation of `sudo` didn't ask me for my password.


=== How to reproduce ===

I don't know!

This is how it happened to me:

I entered `sudo apt update`, and while I was inputting my password, I realized that I'm on Manjaro, not Ubuntu. So I hit Ctrl+C, executed `sudo pacman -Syu`, and it immediately started without ever asking for my password. The update completed successfully, so I do believe it was executed as root.

I've tried to reproduce it, but no dice.


=== How drunk/high/tired/etc are you? ===

Obviously it's possible that I spaced out for a moment and entered my password without realizing, but... I do very much doubt that.


=== System details ===

OS: Manjaro 5.10.42-1 64bit
Shell: fish 3.2.2
Terminal: gnome-terminal 3.40.2

Contents of `/etc/sudoers` (omitting a whole bunch of commented lines):

```
root ALL=(ALL) ALL
@includedir /etc/sudoers.d
```

Contents of `/etc/sudoers.d/10-installer` (the only file in that directory):

```
%wheel ALL=(ALL) ALL
```

Comment 1 Todd C. Miller 2021-07-10 15:22:24 MDT

Is it possible that you entered your password and _then_ interrupted sudo?  If sudo had time to authenticate you successfully and updated the time stamp file that would explain why you didn't need to enter a password for the next command.

Comment 2 Paul Pinterits 2021-07-11 00:44:00 MDT

I'm pretty sure I didn't even finish typing my password.

Considering that a `sudo apt update` would've immediately failed with a "apt: command not found" error, I think it's safe to say that I definitely did not enter my whole password *and* press Enter.