Public bug reported:
On 26.04 (resolute), /usr/bin/sudo comes from the "sudo" alternatives
group: sudo-rs at priority 50, sudo.ws at priority 40.
debian/sudo.alternatives declares /usr/bin/sudoedit and
/usr/share/man/man8/sudoedit.8.gz as slave links of that group. But the
upstream install still creates both paths as symlinks (retargeted to
sudo.ws by debian/patches/sudo-rename-for-alternates.patch), so the
binary package ships them as well:
$ dpkg-deb -c sudo_1.9.17p2-1ubuntu3.2_amd64.deb | grep sudoedit
lrwxrwxrwx root/root 0 2026-10-06 15:13 ./usr/bin/sudoedit -> sudo.ws
lrwxrwxrwx root/root 0 2026-10-06 15:13 ./usr/share/man/man8/sudoedit.8.gz ->
sudo.ws.8.gz
$ dpkg -S /usr/bin/sudoedit /usr/share/man/man8/sudoedit.8.gz
sudo: /usr/bin/sudoedit
sudo: /usr/share/man/man8/sudoedit.8.gz
As a result, every upgrade of sudo goes like this:
1. Unpacking replaces the two alternatives links with the package's own
symlinks, so /usr/bin/sudoedit points at sudo.ws instead of
/etc/alternatives/sudoedit (sudo-rs).
2. On configure, the postinst runs "update-alternatives --install /usr/bin/sudo
sudo /usr/bin/sudo.ws 40 ...". That call finds the group inconsistent and
prints:
update-alternatives: warning: forcing reinstallation of alternative
/usr/lib/cargo/bin/sudo because link group sudo is broken
It then rebuilds the links, and /var/log/alternatives.log records "auto-
repair link group sudo".
The end state is correct, but:
- every sudo security update tells users that their sudo link group is broken;
- between unpack and configure, sudoedit runs sudo.ws instead of the selected
sudo-rs;
- dpkg lists both paths as files of the sudo package, so removing sudo (for
example once sudo-rs is the only provider, bug 2153145) would delete the
sudoedit links that sudo-rs is using.
Found on 26.04.1 during the security update from 1.9.17p2-1ubuntu3.1 to
1.9.17p2-1ubuntu3.2, with sudo-rs 0.2.13-0ubuntu1.2 installed and
selected (auto mode) and dpkg 1.23.7ubuntu1. The release upgrade from
24.04 didn't show it because that upgrade created the group. The 26.10
package, 1.9.17p2-7ubuntu5, ships the same two symlinks and the same
alternatives.
Steps to reproduce: on 26.04 with sudo and sudo-rs installed (the
default), upgrade or reinstall sudo, e.g. "sudo apt install --reinstall
sudo".
Expected: no warning; /usr/bin/sudoedit stays a link to
/etc/alternatives/sudoedit throughout.
Actual: the warning above, on every upgrade or reinstall.
Suggested fix: stop shipping usr/bin/sudoedit and
usr/share/man/man8/sudoedit.8.gz in the sudo binary package, since the
alternatives already provide both, pointing straight at sudo.ws and
sudo.ws.8.gz. For example, remove them in override_dh_auto_install next
to the existing .ws renames; the sudoedit hunks of sudo-rename-for-
alternates.patch are then unneeded. On the upgrade that drops them, dpkg
removes the old links and the postinst recreates them, so the warning
should appear one last time.
The alternatives were introduced in bug 2111419.
** Affects: sudo (Ubuntu)
Importance: Undecided
Status: New
** Tags: resolute
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169902
Title:
Shipped sudoedit symlinks break the sudo alternatives link group on
every upgrade
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2169902/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
