Re: sudo -h localhost

On Thu, 03 Jul 2025 21:48:55 +0200, Marc Haber wrote:

> We have --with-fqdn set in configure. I think it has always been that 
> way. The string "fqdn" does not show up in the sudoers that Debian 
> installs with the package.
>
> Do I see correctly that sudo upstream recommends removing the 
> --with-fqdn option from our configure call?

Yes, that is what I would suggest.  You could still add it to the
default sudoers if you really want it.  That way it is easier to
disable.  That configure option pre-dates it being configurable in
sudoers itself.

> What I see is that removing the --with-fqdn message from configure will 
> probably break existing configurations. Right?

Yes, it will likely break some configurations where there are sudoers
rules that contain a fully-qualified domain name where the system
hostname is not fully-qualified.  I suppose you could just include
a commented out line in sudoers like the following:

# Disable the fqdn option to avoid DNS lookups.
# Defaults !fqdn

and let people disable it if they need to.  At least then it is
more visible.

> Would it make sense to special-case localhost in the FQDN lookup, and/or 
> to not be so loud when a lookup fails?

I'm not sure what you mean about special-casing localhost.  Isn't
the problem that the local hostname is not resolvable and is not
localhost?

It should be possible for sudo to log the unresolved host message
without displaying it to the user.

 - todd
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users