** Description changed: Ubuntu Version Ubuntu 26.04 LTS - Package sudo-rs (default sudo implementation) - Summary - When an LDAP group named "Admin" exists and a local group named "admin" - also exists, sudo-rs fails to match the sudoers rule for %Admin. + On Ubuntu 26.04, sudo-rs does not authorize users through an LDAP-backed + group referenced in sudoers, while the traditional sudo implementation + (sudo.ws) works correctly with the same configuration. - The same configuration works correctly with the traditional sudo - implementation (sudo.ws). + The user is a member of an LDAP group named "Admin". The sudoers file + contains a rule granting privileges to that group. Traditional sudo + correctly recognizes the LDAP group membership and grants access. sudo- + rs does not. - This appears to be a case-sensitivity issue in group resolution or - sudoers matching. - + The issue is reproducible on the same machine with the same user + account, NSS configuration, LDAP configuration, and sudoers file, + indicating a behavioral difference between sudo-rs and sudo.ws. Environment Authentication and group lookup are performed through LDAP. SSSD is not used. LDAP group: Admin (gid 5003) Local group: admin (gid 107) Both groups are visible through NSS and have different GIDs. - sudoers Configuration %Admin ALL=(ALL) NOPASSWD:ALL I also tested with: %admin ALL=(ALL) NOPASSWD:ALL %Admin ALL=(ALL) NOPASSWD:ALL with the same result. - Verification The user is a member of the LDAP group "Admin" and not the local group "admin". The following commands confirm the existence of both groups: getent group Admin getent group admin The groups have different GIDs: Admin -> gid 5003 (LDAP) admin -> gid 107 (local) - Observed Behavior - Using the default sudo implementation (sudo-rs): + Using the default sudo implementation: sudo -l - fails because the %Admin sudoers rule is apparently not matched. + returns: + + sudo: Sorry, user <user> may not run sudo on <host> Using the traditional sudo implementation: sudo.ws -l - works correctly and grants privileges according to the %Admin rule. + returns: + Matching Defaults entries for on : env_reset, mail_badpass, + secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin + + User may run the following commands on : (root) NOPASSWD: ALL Expected Behavior - sudo-rs should behave the same as sudo.ws and treat "Admin" and "admin" - as distinct group names. + sudo-rs should authorize the user through the LDAP group membership in + the same way as sudo.ws. - When a user is a member of the LDAP group "Admin", the sudoers entry: + When a user is a member of the LDAP group "Admin" and the sudoers file + contains: %Admin ALL=(ALL) NOPASSWD:ALL - should be matched and applied. + the rule should be matched and access should be granted. + + Actual Behavior + + sudo-rs does not match the LDAP-backed group rule and denies access + with: + + sudo: Sorry, user may not run sudo on + + while sudo.ws authorizes the user correctly. + + Impact + + Systems using LDAP-based group membership for sudo authorization cannot + rely on sudo-rs to evaluate existing sudoers group rules correctly, even + though the same configuration works with the traditional sudo + implementation.
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2167486 Title: sudo-rs does not honor LDAP group membership for sudoers group rules while sudo.ws works To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/rust-sudo-rs/+bug/2167486/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
