Bug 1062 – commands with relative path no longer working

Bug 1062 - commands with relative path no longer working


Summary:	commands with relative path no longer working

Status:	RESOLVED FIXED

Product:	Sudo
Classification:	Unclassified
Component:	Sudo
Version:	1.9.14
Hardware:	IBM AIX

Importance:	low normal
Assigned To:	Todd C. Miller

URL:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2023-12-03 22:35 MST by mathews.dennis
Modified:	2023-12-13 13:29 MST (History)
CC List:	0 users

See Also:

Attachments
sudo -V output (5.62 KB, text/plain) 2023-12-03 22:35 MST, mathews.dennis	Details
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description mathews.dennis 2023-12-03 22:35:18 MST

Created attachment 576 [details]
sudo -V output

Previously (at least on 1.9.5p2), a config like:
user  ALL=(root)      NOPASSWD: /app/abc/scripts/*

Would allow the use of relative names in the command specification. Eg. 'sudo /app/abc/plugins/../scripts/command'

But now on 1.9.14p3, only absolute command path is allowed. Eg. 'sudo /app/abc/scripts/command'.

I couldn't figure out if this was an intentional change to how sudo works from the changelog and if so when this was introduced

Comment 1 Todd C. Miller 2023-12-04 09:11:45 MST

Yes, that is a bug that was introduced in sudo 1.9.14.  I just committed the fix in https://www.sudo.ws/repos/sudo/rev/e7545a3736c6

Comment 2 Todd C. Miller 2023-12-13 13:29:16 MST

This is fixed in sudo 1.9.15p3.