Re: Apache->CGI script, NOPASSWD is set, but sudo requires auth

On Fri, Mar 06, 2026 at 07:59:20AM +0300, Evgeniy Berdnikov wrote:
>  Hello, Todd.
>  
> On Thu, Mar 05, 2026 at 05:02:35PM -0700, Todd C. Miller wrote:
> > What does "sudo -l -U www-data" display on the non-working host
> > when run by root?  It sounds like there is a later sudoers entry
> > that is matching instead of the NOPASSWD one.
> 
>  It displays exactly the same as on working host, I've tried
>  an exact copy of file sudoers.d/www-data from good one:

 I tried several fresh and old systems, running my test CGI script:

 apache2(2.4.29-1ubuntu4.27) + sudo(1.8.21p2-3ubuntu1.6) -- ok
 apache2(2.4.58-1ubuntu8.10) + sudo(1.9.15p5-3ubuntu5.24.04.1) -- ok
 apache2(2.4.66-8) + sudo(1.9.17p2-4) Debian -- fail

 Probably some sequence of updates from old to fresh system could narrow
 the point of failure, but this way seems too long, and it would not
 answer a question "what happens?" Is there a way to trace sudo? 

 Sudo debug logs shows sequence of called functions, but they have almost
 nothing about logic, namely performed tests and their results.

 PS. A after installation of updates my "working" host become broken, and
 now sudo sends me e-mails with text "www-data : user NOT in sudoers".
 If "sudo -l -U www-data" is called under root, it displays the same
 message as was displayed before update:

> -----------------------------------------------------------------------
> Matching Defaults entries for www-data on udev0:
>     env_reset,
>     secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
>     use_pty
> 
> User www-data may run the following commands on udev0:
>     (root) NOPASSWD: /bin/echo
>     (root) NOPASSWD: /bin/id
> -----------------------------------------------------------------------

-- 
 Eugene Berdnikov
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users