Re: Apache->CGI script, NOPASSWD is set, but sudo requires auth

  Hello, Todd.
  
On Mon, Mar 09, 2026 at 08:18:28PM -0600, Todd C. Miller wrote:
> On Mon, 09 Mar 2026 13:03:24 +0300, Evgeniy Berdnikov wrote:
> 
> >  Sudo debug logs shows sequence of called functions, but they have almost
> >  nothing about logic, namely performed tests and their results.
> 
> The sudoers debug log should also contain information about how the
> user or command was (or was not) matched.
> 
> You should see lines like:
> 
>     user www-data matches sudoers user www-data: ALLOW @ userpw_matches()
> 
> And for the command matching:
> 
>     user command "/bin/id" matches sudoers command "/bin/id": ALLOW @ command_matches()
> 
> A line like this in /etc/sudo.conf will only log the match-related
> data:
> 
>     Debug sudoers.so /var/log/sudoers_debug match@debug,nss@debug

 If such "Debug sudoers.so ... line is added for sudo.conf on working host,
 sudoers_debug contains lines you mentioned above.

 If such line is addedd on non-working hosts, sudoers_debug does not
 contain any "matches" word. Such log for "sudo /bin/id" is small,
 I attach it below.

> Debian, list most (all?) Linux distros, has made /bin a link to
> /usr/bin so you might try updating your sudoers rules and CGI script
> to match.  This should not matter, sudo ought to just follow the
> link, but is worth trying.

 Yes, I tried to insert rules for /bin/id and /usr/bin/id, both works
 on working hosts.

> >  PS. A after installation of updates my "working" host become broken, and
> >  now sudo sends me e-mails with text "www-data : user NOT in sudoers".
> 
> That sounds like a different issue.  Is your cgi script executing
> in a chroot jail by any chance?

 Problem is reproduced inside VM, as well as inside LXC container.
 
 I tried LXC to run container on fresh Debian (where problem is reproduced)
 and on old Ubuntu (where problem is not reproduced), result is the same.
 I think it excludes dependence on systemd and cgroups (on Linux).

 Below is contents of sudoers_debug for "sudo /bin/id" on non-working host,
 with "match@debug,nss@debug":
---------------------------------------------------------------------------
Mar 10 11:07:42.639 sudo[268] -> sudo_getpwnam @ ../../../plugins/sudoers/pwutil.c:285
Mar 10 11:07:42.639 sudo[268] -> sudo_make_pwitem @ ../../../plugins/sudoers/pwutil_impl.c:95
Mar 10 11:07:42.639 sudo[268] <- sudo_make_pwitem @ ../../../plugins/sudoers/pwutil_impl.c:159 := 0x5603c3933330
Mar 10 11:07:42.639 sudo[268] sudo_getpwnam: user www-data [] -> uid 33 [] (cached)
Mar 10 11:07:42.639 sudo[268] <- sudo_getpwnam @ ../../../plugins/sudoers/pwutil.c:345 := 0x5603c3933358
Mar 10 11:07:42.639 sudo[268] -> sudo_set_gidlist @ ../../../plugins/sudoers/pwutil.c:1071
Mar 10 11:07:42.639 sudo[268] sudo_set_gidlist: setting group-IDs for www-data
Mar 10 11:07:42.639 sudo[268] -> sudo_debug_group_list @ ../../../plugins/sudoers/pwutil.c:929
Mar 10 11:07:42.639 sudo[268] <- sudo_debug_group_list @ ../../../plugins/sudoers/pwutil.c:932
Mar 10 11:07:42.639 sudo[268] -> sudo_make_gidlist_item @ ../../../plugins/sudoers/pwutil_impl.c:251
Mar 10 11:07:42.639 sudo[268] <- sudo_make_gidlist_item @ ../../../plugins/sudoers/pwutil_impl.c:348 := 0x5603c3933480
Mar 10 11:07:42.639 sudo[268] <- sudo_set_gidlist @ ../../../plugins/sudoers/pwutil.c:1115 := 0
Mar 10 11:07:42.639 sudo[268] -> sudo_get_gidlist @ ../../../plugins/sudoers/pwutil.c:1010
Mar 10 11:07:42.639 sudo[268] sudo_get_gidlist: looking up group-IDs for www-data
Mar 10 11:07:42.639 sudo[268] <- sudo_get_gidlist @ ../../../plugins/sudoers/pwutil.c:1063 := 0x5603c39334a8
Mar 10 11:07:42.639 sudo[268] -> sudo_gidlist_addref @ ../../../plugins/sudoers/pwutil.c:786
Mar 10 11:07:42.639 sudo[268] <- sudo_gidlist_addref @ ../../../plugins/sudoers/pwutil.c:788
Mar 10 11:07:42.639 sudo[268] -> sudo_getpwnam @ ../../../plugins/sudoers/pwutil.c:285
Mar 10 11:07:42.639 sudo[268] -> sudo_make_pwitem @ ../../../plugins/sudoers/pwutil_impl.c:95
Mar 10 11:07:42.639 sudo[268] <- sudo_make_pwitem @ ../../../plugins/sudoers/pwutil_impl.c:159 := 0x5603c3933530
Mar 10 11:07:42.639 sudo[268] sudo_getpwnam: user root [] -> uid 0 [] (cached)
Mar 10 11:07:42.639 sudo[268] <- sudo_getpwnam @ ../../../plugins/sudoers/pwutil.c:345 := 0x5603c3933558
Mar 10 11:07:42.639 sudo[268] -> sudo_read_nss @ ../../../plugins/sudoers/sudo_nss.c:72
Mar 10 11:07:42.639 sudo[268] <- sudo_read_nss @ ../../../plugins/sudoers/sudo_nss.c:128 := 0x7fbdddedb800
Mar 10 11:07:42.639 sudo[268] -> sudo_gidlist_addref @ ../../../plugins/sudoers/pwutil.c:786
Mar 10 11:07:42.639 sudo[268] <- sudo_gidlist_addref @ ../../../plugins/sudoers/pwutil.c:788
Mar 10 11:07:42.639 sudo[268] -> sudo_file_open @ ../../../plugins/sudoers/file.c:59
Mar 10 11:07:42.639 sudo[268] -> sudo_gidlist_addref @ ../../../plugins/sudoers/pwutil.c:786
Mar 10 11:07:42.639 sudo[268] <- sudo_gidlist_addref @ ../../../plugins/sudoers/pwutil.c:788
Mar 10 11:07:42.639 sudo[268] -> sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:806
Mar 10 11:07:42.639 sudo[268] -> sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:795
Mar 10 11:07:42.639 sudo[268] <- sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:800
Mar 10 11:07:42.639 sudo[268] <- sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:808
Mar 10 11:07:42.639 sudo[268] -> sudo_gidlist_addref @ ../../../plugins/sudoers/pwutil.c:786
Mar 10 11:07:42.639 sudo[268] <- sudo_gidlist_addref @ ../../../plugins/sudoers/pwutil.c:788
Mar 10 11:07:42.639 sudo[268] -> sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:806
Mar 10 11:07:42.639 sudo[268] -> sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:795
Mar 10 11:07:42.639 sudo[268] <- sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:800
Mar 10 11:07:42.639 sudo[268] <- sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:808
Mar 10 11:07:42.639 sudo[268] <- sudo_file_open @ ../../../plugins/sudoers/file.c:91 := 0
Mar 10 11:07:42.639 sudo[268] -> sudo_file_parse @ ../../../plugins/sudoers/file.c:100
Mar 10 11:07:42.639 sudo[268] <- sudo_file_parse @ ../../../plugins/sudoers/file.c:120 := 0x5603c3933668
Mar 10 11:07:42.639 sudo[268] -> sudo_file_getdefs @ ../../../plugins/sudoers/file.c:140
Mar 10 11:07:42.639 sudo[268] <- sudo_file_getdefs @ ../../../plugins/sudoers/file.c:141 := 0
Mar 10 11:07:42.643 sudo[268] -> sudo_getgrgid @ ../../../plugins/sudoers/pwutil.c:537
Mar 10 11:07:42.643 sudo[268] -> sudo_make_gritem @ ../../../plugins/sudoers/pwutil_impl.c:176
Mar 10 11:07:42.643 sudo[268] <- sudo_make_gritem @ ../../../plugins/sudoers/pwutil_impl.c:236 := 0x5603c3933fa0
Mar 10 11:07:42.643 sudo[268] sudo_getgrgid: gid 33 [] -> group www-data [] (cached)
Mar 10 11:07:42.643 sudo[268] <- sudo_getgrgid @ ../../../plugins/sudoers/pwutil.c:591 := 0x5603c3933fc8
Mar 10 11:07:42.643 sudo[268] -> sudo_gr_delref @ ../../../plugins/sudoers/pwutil.c:524
Mar 10 11:07:42.643 sudo[268] -> sudo_gr_delref_item @ ../../../plugins/sudoers/pwutil.c:513
Mar 10 11:07:42.643 sudo[268] <- sudo_gr_delref_item @ ../../../plugins/sudoers/pwutil.c:518
Mar 10 11:07:42.643 sudo[268] <- sudo_gr_delref @ ../../../plugins/sudoers/pwutil.c:526
Mar 10 11:07:42.643 sudo[268] -> sudo_getgrgid @ ../../../plugins/sudoers/pwutil.c:537
Mar 10 11:07:42.643 sudo[268] sudo_getgrgid: gid 33 [] -> group www-data [] (cache hit)
Mar 10 11:07:42.643 sudo[268] <- sudo_getgrgid @ ../../../plugins/sudoers/pwutil.c:591 := 0x5603c3933fc8
Mar 10 11:07:42.643 sudo[268] -> sudo_gr_delref @ ../../../plugins/sudoers/pwutil.c:524
Mar 10 11:07:42.643 sudo[268] -> sudo_gr_delref_item @ ../../../plugins/sudoers/pwutil.c:513
Mar 10 11:07:42.643 sudo[268] <- sudo_gr_delref_item @ ../../../plugins/sudoers/pwutil.c:518
Mar 10 11:07:42.643 sudo[268] <- sudo_gr_delref @ ../../../plugins/sudoers/pwutil.c:526
Mar 10 11:07:42.643 sudo[268] -> sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:806
Mar 10 11:07:42.643 sudo[268] -> sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:795
Mar 10 11:07:42.643 sudo[268] <- sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:800
Mar 10 11:07:42.643 sudo[268] <- sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:808
Mar 10 11:07:42.643 sudo[268] -> sudo_gidlist_addref @ ../../../plugins/sudoers/pwutil.c:786
Mar 10 11:07:42.643 sudo[268] <- sudo_gidlist_addref @ ../../../plugins/sudoers/pwutil.c:788
Mar 10 11:07:42.643 sudo[268] -> runas_getgroups @ ../../../plugins/sudoers/match.c:137
Mar 10 11:07:42.643 sudo[268] -> sudo_get_gidlist @ ../../../plugins/sudoers/pwutil.c:1010
Mar 10 11:07:42.643 sudo[268] sudo_get_gidlist: looking up group-IDs for root
Mar 10 11:07:42.643 sudo[268] -> sudo_make_gidlist_item @ ../../../plugins/sudoers/pwutil_impl.c:251
Mar 10 11:07:42.644 sudo[268] <- sudo_make_gidlist_item @ ../../../plugins/sudoers/pwutil_impl.c:348 := 0x5603c39397b0
Mar 10 11:07:42.644 sudo[268] sudo_get_gidlist: user root has supplementary gid 0
Mar 10 11:07:42.644 sudo[268] <- sudo_get_gidlist @ ../../../plugins/sudoers/pwutil.c:1063 := 0x5603c39397d8
Mar 10 11:07:42.644 sudo[268] <- runas_getgroups @ ../../../plugins/sudoers/match.c:146 := 0x5603c39397d8
Mar 10 11:07:42.644 sudo[268] -> sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:806
Mar 10 11:07:42.644 sudo[268] -> sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:795
Mar 10 11:07:42.644 sudo[268] <- sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:800
Mar 10 11:07:42.644 sudo[268] <- sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:808
Mar 10 11:07:42.644 sudo[268] -> runas_getgroups @ ../../../plugins/sudoers/match.c:137
Mar 10 11:07:42.644 sudo[268] -> sudo_get_gidlist @ ../../../plugins/sudoers/pwutil.c:1010
Mar 10 11:07:42.644 sudo[268] sudo_get_gidlist: looking up group-IDs for root
Mar 10 11:07:42.644 sudo[268] <- sudo_get_gidlist @ ../../../plugins/sudoers/pwutil.c:1063 := 0x5603c39397d8
Mar 10 11:07:42.644 sudo[268] <- runas_getgroups @ ../../../plugins/sudoers/match.c:146 := 0x5603c39397d8
Mar 10 11:07:42.644 sudo[268] -> sudo_file_query @ ../../../plugins/sudoers/file.c:130
Mar 10 11:07:42.644 sudo[268] <- sudo_file_query @ ../../../plugins/sudoers/file.c:131 := 0
Mar 10 11:07:42.644 sudo[268] -> sudo_nss_can_continue @ ../../../plugins/sudoers/sudo_nss.c:253
Mar 10 11:07:42.644 sudo[268] <- sudo_nss_can_continue @ ../../../plugins/sudoers/sudo_nss.c:263 := true
Mar 10 11:07:42.644 sudo[268] -> sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:806
Mar 10 11:07:42.644 sudo[268] -> sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:795
Mar 10 11:07:42.644 sudo[268] <- sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:800
Mar 10 11:07:42.644 sudo[268] <- sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:808
Mar 10 11:07:42.644 sudo[268] -> user_shell_valid @ ../../../plugins/sudoers/pwutil.c:1218
Mar 10 11:07:42.644 sudo[268] <- user_shell_valid @ ../../../plugins/sudoers/pwutil.c:1221 := true
Mar 10 11:07:42.644 sudo[268] -> sudo_pw_addref @ ../../../plugins/sudoers/pwutil.c:181
Mar 10 11:07:42.644 sudo[268] <- sudo_pw_addref @ ../../../plugins/sudoers/pwutil.c:183
Mar 10 11:07:42.649 sudo[268] -> sudo_pw_delref @ ../../../plugins/sudoers/pwutil.c:201
Mar 10 11:07:42.649 sudo[268] -> sudo_pw_delref_item @ ../../../plugins/sudoers/pwutil.c:190
Mar 10 11:07:42.649 sudo[268] <- sudo_pw_delref_item @ ../../../plugins/sudoers/pwutil.c:195
Mar 10 11:07:42.649 sudo[268] <- sudo_pw_delref @ ../../../plugins/sudoers/pwutil.c:203
Mar 10 11:07:42.649 sudo[268] -> sudo_getgrgid @ ../../../plugins/sudoers/pwutil.c:537
Mar 10 11:07:42.649 sudo[268] sudo_getgrgid: gid 33 [] -> group www-data [] (cache hit)
Mar 10 11:07:42.649 sudo[268] <- sudo_getgrgid @ ../../../plugins/sudoers/pwutil.c:591 := 0x5603c3933fc8
Mar 10 11:07:42.649 sudo[268] -> sudo_gr_delref @ ../../../plugins/sudoers/pwutil.c:524
Mar 10 11:07:42.649 sudo[268] -> sudo_gr_delref_item @ ../../../plugins/sudoers/pwutil.c:513
Mar 10 11:07:42.649 sudo[268] <- sudo_gr_delref_item @ ../../../plugins/sudoers/pwutil.c:518
Mar 10 11:07:42.650 sudo[268] <- sudo_gr_delref @ ../../../plugins/sudoers/pwutil.c:526
Mar 10 11:07:42.650 sudo[268] -> sudo_get_gidlist @ ../../../plugins/sudoers/pwutil.c:1010
Mar 10 11:07:42.650 sudo[268] sudo_get_gidlist: looking up group-IDs for root
Mar 10 11:07:42.650 sudo[268] <- sudo_get_gidlist @ ../../../plugins/sudoers/pwutil.c:1063 := 0x5603c39397d8
Mar 10 11:07:42.650 sudo[268] -> sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:806
Mar 10 11:07:42.650 sudo[268] -> sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:795
Mar 10 11:07:42.650 sudo[268] <- sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:800
Mar 10 11:07:42.650 sudo[268] <- sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:808
Mar 10 11:07:42.650 sudo[268] -> sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:806
Mar 10 11:07:42.650 sudo[268] -> sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:795
Mar 10 11:07:42.650 sudo[268] <- sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:800
Mar 10 11:07:42.650 sudo[268] <- sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:808
Mar 10 11:07:42.650 sudo[268] -> sudo_file_close @ ../../../plugins/sudoers/file.c:41
Mar 10 11:07:42.650 sudo[268] <- sudo_file_close @ ../../../plugins/sudoers/file.c:53 := 0
Mar 10 11:07:42.650 sudo[268] -> sudo_pw_delref @ ../../../plugins/sudoers/pwutil.c:201
Mar 10 11:07:42.650 sudo[268] -> sudo_pw_delref_item @ ../../../plugins/sudoers/pwutil.c:190
Mar 10 11:07:42.650 sudo[268] <- sudo_pw_delref_item @ ../../../plugins/sudoers/pwutil.c:195
Mar 10 11:07:42.650 sudo[268] <- sudo_pw_delref @ ../../../plugins/sudoers/pwutil.c:203
Mar 10 11:07:42.650 sudo[268] -> sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:806
Mar 10 11:07:42.650 sudo[268] -> sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:795
Mar 10 11:07:42.650 sudo[268] <- sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:800
Mar 10 11:07:42.650 sudo[268] <- sudo_gidlist_delref @ ../../../plugins/sudoers/pwutil.c:808
Mar 10 11:07:42.650 sudo[268] -> sudo_pw_delref @ ../../../plugins/sudoers/pwutil.c:201
Mar 10 11:07:42.650 sudo[268] -> sudo_pw_delref_item @ ../../../plugins/sudoers/pwutil.c:190
Mar 10 11:07:42.650 sudo[268] <- sudo_pw_delref_item @ ../../../plugins/sudoers/pwutil.c:195
Mar 10 11:07:42.650 sudo[268] <- sudo_pw_delref @ ../../../plugins/sudoers/pwutil.c:203
Mar 10 11:07:42.650 sudo[268] -> sudo_freepwcache @ ../../../plugins/sudoers/pwutil.c:471
Mar 10 11:07:42.650 sudo[268] -> sudo_pw_delref_item @ ../../../plugins/sudoers/pwutil.c:190
Mar 10 11:07:42.650 sudo[268] <- sudo_pw_delref_item @ ../../../plugins/sudoers/pwutil.c:195
Mar 10 11:07:42.650 sudo[268] -> sudo_pw_delref_item @ ../../../plugins/sudoers/pwutil.c:190
Mar 10 11:07:42.650 sudo[268] <- sudo_pw_delref_item @ ../../../plugins/sudoers/pwutil.c:195
Mar 10 11:07:42.650 sudo[268] <- sudo_freepwcache @ ../../../plugins/sudoers/pwutil.c:482
Mar 10 11:07:42.650 sudo[268] -> sudo_freegrcache @ ../../../plugins/sudoers/pwutil.c:842
Mar 10 11:07:42.650 sudo[268] -> sudo_gr_delref_item @ ../../../plugins/sudoers/pwutil.c:513
Mar 10 11:07:42.650 sudo[268] <- sudo_gr_delref_item @ ../../../plugins/sudoers/pwutil.c:518
Mar 10 11:07:42.650 sudo[268] -> sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:795
Mar 10 11:07:42.650 sudo[268] <- sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:800
Mar 10 11:07:42.650 sudo[268] -> sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:795
Mar 10 11:07:42.650 sudo[268] <- sudo_gidlist_delref_item @ ../../../plugins/sudoers/pwutil.c:800
Mar 10 11:07:42.650 sudo[268] <- sudo_freegrcache @ ../../../plugins/sudoers/pwutil.c:861
---------------------------------------------------------------------------
-- 
 Eugene Berdnikov
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users