#1141402 sudo: removal of /usr/local dirs from secure_path breaks existing config/scripts

Package:
sudo
Source:
sudo
Description:
Provide limited super user privileges to specific users
Submitter:
astian
Date:
2026-09-08 20:35:02 UTC
Severity:
normal
Tags:
#1141402#5
Date:
2026-07-03 23:10:37 UTC
From:
To:
Dear Maintainer,

changelog.Debian.gz says:

  sudo (1.9.17p2-6) unstable; urgency=medium
    [...]
    * align /etc/sudoers with what upstream ships.

This changed the secure_path setting from:

  Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

...to:

  Defaults secure_path="/usr/sbin:/usr/bin:/sbin:/bin"

Removing the /usr/local directories, which broke my configuration
(moreover, it broke it during or right after upgrade because my APT
configuration depended on some executables there).

Things work again after re-adding those directories.
#1141402#10
Date:
2026-07-04 11:04:00 UTC
From:
To:
Hello,

Bug #1141402 in sudo reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/sudo-team/sudo/-/commit/92b9d4fae6e1f70645592476c48bd6a92428db1d
------------------------------------------------------------------------
Mention in NEWS that secure_path was shortened

Closes: #1141402
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1141402
#1141402#17
Date:
2026-07-09 21:13:55 UTC
From:
To:
This started already with -6.
#1141402#22
Date:
2026-07-09 21:13:55 UTC
From:
To:
This started already with -6.
#1141402#25
Date:
2026-07-09 21:13:55 UTC
From:
To:
This started already with -6.
#1141402#30
Date:
2026-07-10 14:11:11 UTC
From:
To:
Thanks for proofreading, fixed.

Greetings
Marc
#1141402#35
Date:
2026-07-10 14:11:11 UTC
From:
To:
Thanks for proofreading, fixed.

Greetings
Marc
#1141402#38
Date:
2026-07-10 14:11:11 UTC
From:
To:
Thanks for proofreading, fixed.

Greetings
Marc
#1141402#41
Date:
2026-08-04 05:30:56 UTC
From:
To:
Hello,

Bug #1141402 in sudo reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/sudo-team/sudo/-/commit/92b9d4fae6e1f70645592476c48bd6a92428db1d
------------------------------------------------------------------------
Mention in NEWS that secure_path was shortened

Closes: #1141402
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1141402
#1141402#46
Date:
2026-09-08 20:34:06 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
sudo, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1141402@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Marc Haber <mh+debian-packages@zugschlus.de> (supplier of updated sudo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 08 Sep 2026 16:22:41 +0200
Source: sudo
Architecture: source
Version: 1.9.17p2-8
Distribution: unstable
Urgency: medium
Maintainer: Debian Sudo Maintainers <sudo@packages.debian.org>
Changed-By: Marc Haber <mh+debian-packages@zugschlus.de>
Closes: 1141402
Changes:
 sudo (1.9.17p2-8) unstable; urgency=medium
 .
   * Mention in NEWS that secure_path was shortened (Closes: #1141402)
   * replace b-d libsasl2-dev with libssl-dev
   * Update copyright years for recent contributors
   * Apply consistent formatting to packaging files.
   * Bump Debian Policy version to 4.7.4.
   * Fix issues found by Shellcheck.
   * Fix spelling.
 .
   [ Danilo Egea Gondolfo ]
   * debian/tests/04-getroot-sssd:
       + Check if the slapd daemon is ready before proceeding.
         In some situations, the next command (ldapmodify) runs before
         the service is ready. See LP:#2026888
     (cherry picked from commit 91d20afb79e34b10b46c3cc0b219e7e766677fd3)
     Signed-off-by: Mitchell Augustin <mitchell.augustin@canonical.com>
Checksums-Sha1:
 5650858d7ea206a0fb12b6602abaeea86e1003a6 2258 sudo_1.9.17p2-8.dsc
 9b96295cc5256dfe2730a52f54e40905246efdba 51488 sudo_1.9.17p2-8.debian.tar.xz
Checksums-Sha256:
 f8f467d15508827571bee3c20e13fff5e2686074b7d6cf85daf2c4c2d7fee2db 2258 sudo_1.9.17p2-8.dsc
 c40c0dbf553a45fbdb945602ab229003b0333d6fd299bba2979118d162c2a814 51488 sudo_1.9.17p2-8.debian.tar.xz
Files:
 689c9bc10ea08b96a9d58883fea069af 2258 admin optional sudo_1.9.17p2-8.dsc
 b06e5a2dac121ddf196d4cf1aa4f7095 51488 admin optional sudo_1.9.17p2-8.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRoUtdjQYCq5giMg+rVTTAMN2ORyQUCaqBt9QAKCRDVTTAMN2OR
yUbCAQDyl+KWzabqks0snt+gDtrIJwSdCq87I6bEw8OtneGQUQD9FWHJxba6d+uv
PETkAnGnlKXkNFKtSx8mNAuH5uYdVgs=
=U3YV
-----END PGP SIGNATURE-----