Re: sudo -h localhost

Hi,

On Thu, Jul 03, 2025 at 02:06:16PM -0600, Todd C. Miller wrote:
>On Thu, 03 Jul 2025 21:48:55 +0200, Marc Haber wrote:
>> We have --with-fqdn set in configure. I think it has always been that
>> way. The string "fqdn" does not show up in the sudoers that Debian
>> installs with the package.
>>
>> Do I see correctly that sudo upstream recommends removing the
>> --with-fqdn option from our configure call?
>
>Yes, that is what I would suggest.  You could still add it to the
>default sudoers if you really want it.  That way it is easier to
>disable.  That configure option pre-dates it being configurable in
>sudoers itself.
>
>> What I see is that removing the --with-fqdn message from configure will
>> probably break existing configurations. Right?
>
>Yes, it will likely break some configurations where there are sudoers
>rules that contain a fully-qualified domain name where the system
>hostname is not fully-qualified.  I suppose you could just include
>a commented out line in sudoers like the following:
>
># Disable the fqdn option to avoid DNS lookups.
># Defaults !fqdn
>
>and let people disable it if they need to.  At least then it is
>more visible.

Yes, that sounds like a very good idea. It's too late do to that change 
for Debian trixie, but I will do that right after the release. Thank you 
very much for this valueable input.

>> Would it make sense to special-case localhost in the FQDN lookup, and/or
>> to not be so loud when a lookup fails?
>
>I'm not sure what you mean about special-casing localhost.  Isn't
>the problem that the local hostname is not resolvable and is not
>localhost?

My idea would be to not do any lookup if the hostname given to -h is 
localhost. Or is the idea to have the rules for host 
cadencia.zugschlus.de be honored if I do sudo -h localhost on cadencia? 
In that case it is obviously necessary to do the lookup.

>It should be possible for sudo to log the unresolved host message
>without displaying it to the user.

Sounds good. But it's late and hot. I'll leave that decision to you 
since you know much better what the issues with that could be.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users