Bug 981 - sudo didn't ask for my password
sudo didn't ask for my password
Status: ASSIGNED
Product: Sudo
Classification: Unclassified
Component: Sudo
1.9.7
PC Linux
: low security
Assigned To: Todd C. Miller
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-07-10 11:54 MDT by Paul Pinterits
Modified: 2021-07-11 00:44 MDT (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Paul Pinterits 2021-07-10 11:54:49 MDT
This is probably gonna be hard to believe, but I figured it's worth reporting anyhow.


=== The bug ===

After cancelling a `sudo` with a keyboard interrupt, the next invocation of `sudo` didn't ask me for my password.


=== How to reproduce ===

I don't know!

This is how it happened to me:

I entered `sudo apt update`, and while I was inputting my password, I realized that I'm on Manjaro, not Ubuntu. So I hit Ctrl+C, executed `sudo pacman -Syu`, and it immediately started without ever asking for my password. The update completed successfully, so I do believe it was executed as root.

I've tried to reproduce it, but no dice.


=== How drunk/high/tired/etc are you? ===

Obviously it's possible that I spaced out for a moment and entered my password without realizing, but... I do very much doubt that.


=== System details ===

OS: Manjaro 5.10.42-1 64bit
Shell: fish 3.2.2
Terminal: gnome-terminal 3.40.2

Contents of `/etc/sudoers` (omitting a whole bunch of commented lines):

```
root ALL=(ALL) ALL
@includedir /etc/sudoers.d
```

Contents of `/etc/sudoers.d/10-installer` (the only file in that directory):

```
%wheel ALL=(ALL) ALL
```
Comment 1 Todd C. Miller 2021-07-10 15:22:24 MDT
Is it possible that you entered your password and _then_ interrupted sudo?  If sudo had time to authenticate you successfully and updated the time stamp file that would explain why you didn't need to enter a password for the next command.
Comment 2 Paul Pinterits 2021-07-11 00:44:00 MDT
I'm pretty sure I didn't even finish typing my password.

Considering that a `sudo apt update` would've immediately failed with a "apt: command not found" error, I think it's safe to say that I definitely did not enter my whole password *and* press Enter.