Bug#1147179: sudo.nss: Add sudoers: files entry to nsswitch.conf

[Mike Gabriel]

On  Mi 09 Sep 2026 20:01:37 CEST, Marc Haber wrote:

And putting that in sudo.nss package does it right?

YEZZZ, it does!

What I tested:

  * build sudo from unstable with this patch:

```
diff -Nru sudo-1.9.17p2/debian/changelog sudo-1.9.17p2/debian/changelog
--- sudo-1.9.17p2/debian/changelog      2026-09-08 14:22:41.000000000 +0000
+++ sudo-1.9.17p2/debian/changelog      2026-09-09 20:32:38.000000000 +0000
@@ -1,3 +1,10 @@
+sudo (1.9.17p2-9~sunweaver1) UNRELEASED; urgency=medium
+
+  * debian/sudo.nss:
+    + Authoritatively manage sudoers: entry in nsswitch.conf.
+
+ --  <locadm@libsss-sudo-1129522>  Wed, 09 Sep 2026 20:32:38 +0000
+
 sudo (1.9.17p2-8) unstable; urgency=medium

   * Mention in NEWS that secure_path was shortened (Closes: #1141402)
diff -Nru sudo-1.9.17p2/debian/sudo.nss sudo-1.9.17p2/debian/sudo.nss
--- sudo-1.9.17p2/debian/sudo.nss       1970-01-01 00:00:00.000000000 +0000
+++ sudo-1.9.17p2/debian/sudo.nss       2026-09-09 20:32:38.000000000 +0000
@@ -0,0 +1,3 @@
+sudoers database-add
+
+sudoers first           files
```
  * build sssd with this patch:

```
diff -Nru sssd-2.13.1/debian/changelog sssd-2.13.1/debian/changelog
--- sssd-2.13.1/debian/changelog        2026-09-08 13:05:35.000000000 +0200
+++ sssd-2.13.1/debian/changelog        2026-09-08 22:15:48.000000000 +0200
@@ -1,3 +1,13 @@
+sssd (2.13.1-4~local2) unstable; urgency=medium
+
+  * Team upload.
+
+  * debian/libsss-sudo.nss:
+    + Since 1.9.17p2-9, the sudoers: entry is managed by the sudo package and
+      libsss-sudo can simply piggy-back on that. (Closes: #1129522).
+
+ -- Mike Gabriel <sunwea...@debian.org>  Tue, 08 Sep 2026 22:15:48 +0200
+
 sssd (2.13.1-3) unstable; urgency=medium


diff -Nru sssd-2.13.1/debian/control sssd-2.13.1/debian/control
--- sssd-2.13.1/debian/control  2026-09-08 13:05:33.000000000 +0200
+++ sssd-2.13.1/debian/control  2026-09-08 22:15:48.000000000 +0200
@@ -372,6 +372,7 @@
 Package: libsss-sudo
 Section: libs
 Architecture: any
+Pre-Depends: sudo (>= 1.9.17p2-9~), ${misc:Pre-Depends}
 Depends: ${misc:Depends}, ${shlibs:Depends}
 Description: Communicator library for sudo
  Utility library to allow communication between sudo and SSSD for caching

--- sssd-2.13.1/debian/libsss-sudo.nss  2026-09-08 13:05:33.000000000 +0200
+++ sssd-2.13.1/debian/libsss-sudo.nss  2026-09-08 22:15:48.000000000 +0200
@@ -1,3 +1,3 @@
-sudoers        database-add
+sudoers        database-require

-sudoers last   sss
+sudoers        after=files     sss
```

  * install sudo, `sudoers: files` appears in nsswitch.conf
  * install libsss-sudo on top, `sudoers: files sss` is seen in nsswitch.conf
  * remove libsss-sudo again, back at `sudoers: files` again in nsswitch.conf
  * remove sudo, sudoers: key gets removed from nsswitch.conf

Mike
--

mike gabriel aka sunweaver (Debian Developer)
mobile: +49 (1520) 1976 148
landline: +49 (4351) 486 14 27

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: sunwea...@debian.org, http://sunweavers.net

* debian/tests/control: Explicitly have tests requiring openssh-client depend diff -Nru sssd-2.13.1/debian/libsss-sudo.nss sssd-2.13.1/debian/libsss-sudo.nss

pgp01BWWUfz5n.pgp
Description: Digitale PGP-Signatur