Re: Apache->CGI script, NOPASSWD is set, but sudo requires auth

  Hello, Todd.
  
On Thu, Mar 12, 2026 at 02:02:34PM +0300, Evgeniy Berdnikov wrote:
>  This issue was resolved. I run strace on Apache processes and found
> 
> 217454 openat(AT_FDCWD, "/etc/sudoers", O_RDONLY|O_NONBLOCK) = -1 EACCES (Permission denied)
> 
>  while /etc/sudoers should be read from suid program.

 Some additional comments. Analysis of this situation was complicated
 by the fact sudo does not output any errors in this combination of factors:
 sudo runs with euid=0, file exists, but if can't be opened for reading.
 This combination is possible with AppArmor or SELiniux running, as well as
 with Systemd unit parameters, so it should be detected. Moreover, the
 "file does not exist" and "file is not readable" are different situations.
 Fist one corresponds to errno=ENOENT from open(2), second one to EACCESS.
 While first is normal situation (no config, should apply defaults),
 the second is accident, it requires at least error message (if sudo is
 running in interactive session with tty), or even e-mail to root,
 if sudo is running non-interactive and without tty.

 But studing the sources, I found that return status of open(2) is ignored
 if euid=0. Relevant lines from open_file() in plugins/sudoers/sudoers.c:

    fd = open(path, flags);
    if (fd == -1 && errno == EACCES && geteuid() != ROOT_UID) {
        /*
         * If we tried to open sudoers as non-root but got EACCES,
         * try again as root.
         */
        int serrno = errno;
        if (restore_perms() && set_perms(NULL, PERM_ROOT))
            fd = open(path, flags);
        errno = serrno;
    }

 Then errno is not checked, neither in open_file(), no in open_sudoers().
 I consider such behavior as a BUG of sudo.
-- 
 Eugene Berdnikov
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users