Dear Maintainer,

sudo does not seem to parse regular expressions in sudoers files properly.
man sudo states it should be able to do so since 1.9.10.
I have not tested the debian testing version (1.9.16) as I am not comfortable replacing an important security binary with a testing version.

I found this while building an instanced systemd service for minecraft servers.
Ideally, I want users of the group "minecraft" to be able to start / stop / restart any instance of the service.
One such instance (for example purposes) is named "vanilla".

I tried to put the following in /etc/sudoers.d/minecraft:

%minecraft ALL= NOPASSWD: /bin/systemctl start minecraft@^[a-zA-Z0-9_]+$
(and equivalent for stop and restart)

visudo finds no errors but the line is not taken into account.
simpler variants of the regex such as minecraft@^vanilla$ or ^minecraft@vanilla$ do not work either.

Manually typing the instance names with no regex works:

%minecraft ALL= NOPASSWD: /bin/systemctl start minecraft@vanilla

Sudoers wildcards also work:

%minecraft ALL= NOPASSWD: /bin/systemctl start minecraft@*

but are not acceptable in this situation, since * matches whitespace, allowing commands such as

sudo systemctl stop minecraft@vanilla critical_service

Best,
François

You should not install binary packages from testing on stable anyway.
Good decision.

If it is a bug in sudo, it is not going to be addressed in Debian 12,
though, and I apologize for that.

I have not tried this myself, but the man page says:

|       A  command is a fully qualified file name, which may include shell-style
|       wildcards (see the “Wildcards” section below), or a  regular  expression
|       that  starts  with  ‘^’ and ends with ‘$’ (see the “Regular expressions”
|       section below).

It doesn't say that you can arbitrarily mix string literals and regexps.

Did you try

%minecraft ALL= NOPASSWD: ^/bin/systemctl start minecraft@[a-zA-Z0-9_]+$

I don't know whether the @ or the + need escaping. Try all variants
please.

There is also language saying

|       Command line arguments can
|       include wildcards or be a regular expression that starts  with  ‘^’  and
|       ends  with ‘$’.  If the command line arguments consist of ‘""’, the com‐
|       mand may only be run with no arguments.

So

%minecraft ALL= NOPASSWD: /bin/systemctl ^start minecraft@[a-zA-Z0-9_]+$

might also work, but this still doesn't give any indication that your
mixture of a regexp and a string literal works.

Greetings
Marc

Hi Marc,

Thanks for the lightning fast reply.

This does not work, but...

...this does. Thus, problem solved for my use case. Thanks a lot!

Digging deeper, if I understand the EBNF notation in the manpage properly:

command name ::= regex |
                 file name

command ::= command name |
            command name args |
            command name regex |
            command name '""' |
            ALL

then "command name" should be able to be a regex too.
Since in your first suggestion command name and args are part of the same regex, I tried splitting them:

%minecraft ALL= NOPASSWD: ^/bin/systemctl$ ^start minecraft@[a-zA-Z0-9_]+$

However, this still does not work.
Just in case, I also tried forfeiting the second regex, which did not help:

%minecraft ALL= NOPASSWD: ^/bin/systemctl$ start minecraft@vanilla

Thus I'd argue there is still a bug.

Best,
François

Would you mind taking this to the upstream mailing list? Todd might be
helpful here, and probably develop a fix.

That fix will, however, NOT go into Debian 12. It might be in Debian 13.

Greetings
Marc

Control: tags -1
thanks

Did that happen? Did Upstream respond?

If that did not happen, is is possible that you, as the bug reporter,
can suggest concise wording that I can use for an upstream bug?

Greetings
Marc

Control: tags -1
thanks

Did that happen? Did Upstream respond?

If that did not happen, is is possible that you, as the bug reporter,
can suggest concise wording that I can use for an upstream bug?

Greetings
Marc