Re: Apache->CGI script, NOPASSWD is set, but sudo requires auth

On 09/03/2026 10:03, Evgeniy Berdnikov wrote:
> On Fri, Mar 06, 2026 at 07:59:20AM +0300, Evgeniy Berdnikov wrote:
>>   Hello, Todd.
>>   
>> On Thu, Mar 05, 2026 at 05:02:35PM -0700, Todd C. Miller wrote:
>>> What does "sudo -l -U www-data" display on the non-working host
>>> when run by root?  It sounds like there is a later sudoers entry
>>> that is matching instead of the NOPASSWD one.
>>   It displays exactly the same as on working host, I've tried
>>   an exact copy of file sudoers.d/www-data from good one:
>   I tried several fresh and old systems, running my test CGI script:
>
>   apache2(2.4.29-1ubuntu4.27) + sudo(1.8.21p2-3ubuntu1.6) -- ok
>   apache2(2.4.58-1ubuntu8.10) + sudo(1.9.15p5-3ubuntu5.24.04.1) -- ok
>   apache2(2.4.66-8) + sudo(1.9.17p2-4) Debian -- fail
>
>   Probably some sequence of updates from old to fresh system could narrow
>   the point of failure, but this way seems too long, and it would not
>   answer a question "what happens?" Is there a way to trace sudo?
>
>   Sudo debug logs shows sequence of called functions, but they have almost
>   nothing about logic, namely performed tests and their results.
>
>   PS. A after installation of updates my "working" host become broken, and
>   now sudo sends me e-mails with text "www-data : user NOT in sudoers".
>   If "sudo -l -U www-data" is called under root, it displays the same
>   message as was displayed before update:

Are group memberships for www-data the same on both hosts? There could 
be a more restrictive group based control that is relevant on one system 
only.

David - not a sudo expert, but I've used it on may sites.


____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users