Bugzilla – Bug 918
Having read only file system will effectively disable sudo
Last modified: 2020-03-01 08:59:12 MST
Hi. I had a server turn the root file system into read only after a file system corruption and when I tried to investigate it using sudo, it no longer allows me to run any sudo commands as sudo quits saying that /var/log/sudo-io/ is read only and cannot be written with sudoreplay in effect. Somehow I still could run 'sudo reboot' but is there a way to run sudo in these situations? I do not really want non root users to be able to disable sudo logging as enforcing it was part of the reason I use it for security auditing. I cannot think of a good way to circumvent but possibly write the log to memory (or a predefined tmpfs) until the file system becomes writeable again? Thanks.
If you set the ignore_iolog_errors flag in sudo, you will be able to run commands even when I/O logging cannot be performed. E.g. Defaults ignore_iolog_errors The reason you could run reboot is due to a line in sudoers that disables log_output for the reboot command. Something like: Cmnd_Alias REBOOT = /sbin/halt, /sbin/reboot, /sbin/poweroff Defaults!REBOOT !log_output
Thank you for the config tip!