2

Ran dist-upgrade today and noticed that sudo update wants to rewrite my /etc/sudoers. Upon reading the diff it seems that my sudo privilege would be removed by that update.

Found related question here (unfortunately closed, so I couldn't react): https://serverfault.com/questions/800112/ec2-ubuntu-server-sudo-lock-out-bug-sudoers-update

Pasted log from my console here (jiri is my username): http://pastebin.com/wZkMFFux

Kept my current version of config file, but if I did overwrite it, I understand that I would lose sudo privileges on my production server without any chance to get it back.

What does it mean? Is this normal behaviour of sudo update? It seems quite dangerous to me...

1
  • May I ask what was the exact command you typed to run dist-upgrade?
    – Anwar
    Sep 6, 2016 at 14:32

1 Answer 1

3

The difference is that

  • /snap/bin is added to the secure_path variable, which should be done, at least if you have any snaps installed.

  • jiri ALL=(ALL:ALL) ALL would be removed, which granted the user jiri full root-sudo privileges.

So the second change would remove user jiri's explicitly configured sudo privilege.

However, on Ubuntu you should normally not add user accounts to /etc/sudoers manually but add them to the user group sudo instead. That one is configured by the line %sudo ALL=(ALL:ALL) ALL which obviously stays intact.

So if your user jiri is in the sudo group (verify by running groups jiri), you can remove that line in question without worries. If not, you should add user jiri to the sudo group (by running sudo adduser jiri sudo) and remove the line in question afterwards.

5
  • 1
    Is that system configured to allow jiri to act as root without sudo'ing?...
    – T.J.L.
    Sep 6, 2016 at 14:49
  • @T.J.L. No, that is impossible. The /etc/sudoers config file only controls the behaviour of sudo.
    – Byte Commander
    Sep 6, 2016 at 15:06
  • That's what I thought. I can't figure out why this was done in the first place.
    – T.J.L.
    Sep 6, 2016 at 15:08
  • @T.J.L. It was configured to grant user jiri explicit sudo privileges instead of doing it via the sudo user group. Maybe that's how folks are supposed to do it on Debian or Arch or so, they don't use sudo the way we do on Ubuntu IIRC.
    – Byte Commander
    Sep 6, 2016 at 15:12
  • I'm sure that I didn't add user jiri to /etc/sudoers, I have no idea how it happened to be there (now I can see it's not there on my main PC). User jiri is also correctly in sudo group as you said, so I'm going to apply the patch manually. Thanks for your explanation. Sep 6, 2016 at 18:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .