Hi,
I am not quite sure that this is a bug. Please add a reproducer that I
can just cut&paste.
Please also discuss this on the sudo users mailing list and if you have
positive feedback from the mailing list, please reopen this bug. As this
is most probably an upstream issue, it would also be a good idea to open
a bug on upstream's bugzilla and to reference the upstream bug number
here.
Greetings
Marc
On Tue, Sep 29, 2026 at 07:40:00AM +0000, [email protected] wrote:
In a sudoers.d file for a specific user, I added a spec:
{user} ALL=({username}) {command-path} {command arg}
(note that braces here means "not literally"...)
Execution of sudo for that user would be rejected.
{user} ALL=({username}) {command-path}
That would be accepted! (omit the args...) Problem is: the argument is important to
implement a "least-privilege" policy (it restricts a user to a specific
database...)
The sudoers parsing of the sudo package appears to be doing something weird
with regards to the command+command args. I tried various quoting and escaping,
and it still would not work...
--
-----------------------------------------------------------------------------
Marc Haber | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421
