Public bug reported:
Ubuntu Version
Ubuntu 26.04 LTS
Package
sudo-rs (default sudo implementation)
Summary
When an LDAP group named "Admin" exists and a local group named "admin"
also exists, sudo-rs fails to match the sudoers rule for %Admin.
The same configuration works correctly with the traditional sudo
implementation (sudo.ws).
This appears to be a case-sensitivity issue in group resolution or
sudoers matching.
Environment
Authentication and group lookup are performed through LDAP.
SSSD is not used.
LDAP group: Admin (gid 5003)
Local group: admin (gid 107)
Both groups are visible through NSS and have different GIDs.
sudoers Configuration
%Admin ALL=(ALL) NOPASSWD:ALL
I also tested with:
%admin ALL=(ALL) NOPASSWD:ALL
%Admin ALL=(ALL) NOPASSWD:ALL
with the same result.
Verification
The user is a member of the LDAP group "Admin" and not the local group
"admin".
The following commands confirm the existence of both groups:
getent group Admin
getent group admin
The groups have different GIDs:
Admin -> gid 5003 (LDAP)
admin -> gid 107 (local)
Observed Behavior
Using the default sudo implementation (sudo-rs):
sudo -l
fails because the %Admin sudoers rule is apparently not matched.
Using the traditional sudo implementation:
sudo.ws -l
works correctly and grants privileges according to the %Admin rule.
Expected Behavior
sudo-rs should behave the same as sudo.ws and treat "Admin" and "admin"
as distinct group names.
When a user is a member of the LDAP group "Admin", the sudoers entry:
%Admin ALL=(ALL) NOPASSWD:ALL
should be matched and applied.
** Affects: rust-sudo-rs (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167486
Title:
sudo-rs does not honor LDAP group membership for sudoers group rules
while sudo.ws works
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rust-sudo-rs/+bug/2167486/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
