Package: sudo Version: 1.9.17p2-7 Severity: wishlist Hi Marc, in the course of getting sssd back into Debian testing, I came across this last RC bug to fix: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129522 The bug report is valid and reproducible in a test setup. In a previous bug fix, it was decided that libsss-sudo owns the sudoers: entry in nsswitch.conf. When we install the package, it adds sudoers: sss and sudo immediately stops seeing /etc/sudoers. There are two meaningful approaches how to address this: add the sudoers: entry to base-files (and make it an official field in nsswitch.conf) or (and I think this hadn't come up, so far) sudo itself owns that nsswitch.conf key/entry. In fact, sudo works well with /etc/sudoers without an entry in nsswitch.conf. However, it does not hurt if `sudoers: files` exists in nsswitch.conf, either. And what package could better own this entry in nsswitch.conf than sudo itself??? So here is my idea: * you add a debian/sudo.nss file into the sudo src:pkg with the following content: ``` sudoers database-add sudoers first files ``` * And for all other consumers, such as sssd, we add: debian/control: Pre-Depends: sudo (>= <version-that-adds-the-above-file>) debian/lib<foo>-sudo.nss ``` sudoers database-require sudoers after=files <foo> ``` What do you think? If I have to fix #1129522 only from within libsss-sudo, it gets really hacky and I'd like to avoid that. Thanks! Mike
Hi Mike, Shouldn't src:sudo's libsss-sudo.deb deliver that file, and to where? I am planning to do an experimental upload of sudo soonish, so we can actually try that. I'd like to hear the oder sudo team members' opinion first, though. In the long run, Debian should have a package like nss-helper that can own the nss files and provide programmatic interfaces to them. This should be discussed on debian-devel. But of course we need a quickfix for this because of sssd. Greetings Marc
Hi Marc,
```
sudoers database-add
sudoers first files
sudoers last sss
```
And it nearly worked:
CASE-1: OK
* no sudoers: key in nsswitch.conf
-> result (on install): sudoers: files sss (correct)
-> result (after removal): no sudoers: key anymore (correct)
CASE-2: FLAWED
* `sudoers: files` in nsswitch.conf
-> result (on install): `sudoers: files` (so unchanged, wrong!)
-> result (on removal): no sudoers: key anymore (also wrong)
CASE-3: FLAWED
* `sudoers: files ldap` in nsswitch.conf
-> result (on install): `sudoers: files ldap` (wrong, should be:
files ldap sss)
-> result (on removal): `sudoers: ldap` (also wrong, should be:
files ldap)
* etc.
Great!!!
Indeed. Though, not as high a prio for me as the solving the current
situation.
That'd be great. Thanks!
Mike
Hi Mike, I wasn't aware of dh_installnss. Ignore the questions in my previous mails that could be answered by man dh_installnss. Why is that wrong? Why is that wrong? I understand why that is flawed. And putting that in sudo.nss package does it right? I just mailed a proposed specification. Greetings Marc
Hi Marc, sss`, not `sudoers: files`. The point is, that dh_installnss cannot handle adding two nss providers in one .nss file gracefully. back to that. But it removes the complete sudoers: key (note, again with the above .nss config for libsss-sudo). Yes, I assume it will. (I must admit, it is a theory, but I can test that). Ack. Mike
YEZZZ, it does!
What I tested:
* build sudo from unstable with this patch:
```
diff -Nru sudo-1.9.17p2/debian/changelog sudo-1.9.17p2/debian/changelog
--- sudo-1.9.17p2/debian/changelog 2026-09-08 14:22:41.000000000 +0000
+++ sudo-1.9.17p2/debian/changelog 2026-09-09 20:32:38.000000000 +0000
@@ -1,3 +1,10 @@
+sudo (1.9.17p2-9~sunweaver1) UNRELEASED; urgency=medium
+
+ * debian/sudo.nss:
+ + Authoritatively manage sudoers: entry in nsswitch.conf.
+
+ -- <locadm@libsss-sudo-1129522> Wed, 09 Sep 2026 20:32:38 +0000
+
sudo (1.9.17p2-8) unstable; urgency=medium
* Mention in NEWS that secure_path was shortened (Closes: #1141402)
diff -Nru sudo-1.9.17p2/debian/sudo.nss sudo-1.9.17p2/debian/sudo.nss
--- sudo-1.9.17p2/debian/sudo.nss 1970-01-01 00:00:00.000000000 +0000
+++ sudo-1.9.17p2/debian/sudo.nss 2026-09-09 20:32:38.000000000 +0000
@@ -0,0 +1,3 @@
+sudoers database-add
+
+sudoers first files
```
* build sssd with this patch:
```
diff -Nru sssd-2.13.1/debian/changelog sssd-2.13.1/debian/changelog
--- sssd-2.13.1/debian/changelog 2026-09-08 13:05:35.000000000 +0200
+++ sssd-2.13.1/debian/changelog 2026-09-08 22:15:48.000000000 +0200
@@ -1,3 +1,13 @@
+sssd (2.13.1-4~local2) unstable; urgency=medium
+
+ * Team upload.
+
+ * debian/libsss-sudo.nss:
+ + Since 1.9.17p2-9, the sudoers: entry is managed by the sudo package and
+ libsss-sudo can simply piggy-back on that. (Closes: #1129522).
+
+ -- Mike Gabriel <sunweaver@debian.org> Tue, 08 Sep 2026 22:15:48 +0200
+
sssd (2.13.1-3) unstable; urgency=medium
* debian/tests/control: Explicitly have tests requiring
openssh-client depend
diff -Nru sssd-2.13.1/debian/control sssd-2.13.1/debian/control
--- sssd-2.13.1/debian/control 2026-09-08 13:05:33.000000000 +0200
+++ sssd-2.13.1/debian/control 2026-09-08 22:15:48.000000000 +0200
@@ -372,6 +372,7 @@
Package: libsss-sudo
Section: libs
Architecture: any
+Pre-Depends: sudo (>= 1.9.17p2-9~), ${misc:Pre-Depends}
Depends: ${misc:Depends}, ${shlibs:Depends}
Description: Communicator library for sudo
Utility library to allow communication between sudo and SSSD for caching
diff -Nru sssd-2.13.1/debian/libsss-sudo.nss
sssd-2.13.1/debian/libsss-sudo.nss
--- sssd-2.13.1/debian/libsss-sudo.nss 2026-09-08 13:05:33.000000000 +0200
+++ sssd-2.13.1/debian/libsss-sudo.nss 2026-09-08 22:15:48.000000000 +0200
@@ -1,3 +1,3 @@
-sudoers database-add
+sudoers database-require
Hi Marc, Any ETA for an upload that fixes this bug (#1147179)? If the route described in my bug report is the viable solution, then getting sssd back into Debian testing depends on fixing this bug. Mike
Doing this and installing the resulting package causes nsswitch.conf to grow a line "sudoers:" with nothing after the colon. Is that the indended result? Greetings Marc
Hi Marc, Ouch. Indeed. Just tested on a fresh system (Debian testing machine). Let me check my incus container where I debugged the whole topic. One sec... Mike
Hi Marc,
I can confirm your observation when upgrading from 1.9.17p2-8 to my
patched version:
```
diff -Nru sudo-1.9.17p2/debian/changelog sudo-1.9.17p2/debian/changelog
--- sudo-1.9.17p2/debian/changelog 2026-09-08 14:22:41.000000000 +0000
+++ sudo-1.9.17p2/debian/changelog 2026-09-09 20:32:38.000000000 +0000
@@ -1,3 +1,10 @@
+sudo (1.9.17p2-9~sunweaver1) UNRELEASED; urgency=medium
+
+ * debian/sudo.nss:
+ + Authoritatively manage sudoers: entry in nsswitch.conf.
+
+ -- <locadm@libsss-sudo-1129522> Wed, 09 Sep 2026 20:32:38 +0000
+
sudo (1.9.17p2-8) unstable; urgency=medium
* Mention in NEWS that secure_path was shortened (Closes: #1141402)
diff -Nru sudo-1.9.17p2/debian/sudo.nss sudo-1.9.17p2/debian/sudo.nss
--- sudo-1.9.17p2/debian/sudo.nss 1970-01-01 00:00:00.000000000 +0000
+++ sudo-1.9.17p2/debian/sudo.nss 2026-09-09 20:32:38.000000000 +0000
@@ -0,0 +1,3 @@
+sudoers database-add
+
+sudoers first files
```
When purging sudo and installing anew, the nsswitch.conf looks good.
This probably means there is something wrong with dh-nss. .o( #!$?(%§$%§ )
Taking a closer look.
Mike
Hi Marc, This needs to be addressed in dh-nss. I have proposed a fix via: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148069 Thanks for being on that journey with me! Mike
So we are on hold while this is being sorted out? Greetings Marc
Hi Gioele, hi all,
ping via BTS @ dh-nss maintainer, cross-posting to the other related
bugs affected by this, to keep other people in the loop.
People start asking about when sssd is fixed (because autofs is also
impacted by sssd not being in testing).
For the background story and how this all is related:
* autofs is not in testing, because sssd is not in testing
* sssd is not in testing because of #1129522
* to get sssd fixed (#1129522) it needs sudo bug #1147179 getting fixed
* to get the approach suggested in #1147179 fully functional dh-nss needs
love (#1148069)
* this also impact the Debian Edu 14 development, but this is not so
pressing at the moment, because we are still busy with fine-polishing
the Debian Edu 13 release
@Gioele (dh-nss maintainer): let me know if there is anything we can
do to speed up the upcoming dh-nss release. Thanks.
Cheers,
Mike
Control: tags 1148069 - patch simple fix like the one proposed here does not properly cover all the possible upgrade paths (for arbitrary changes to .nss files). Upgrades are hard. I'll try now a different strategy: making the maintscript snippets go back to a clean state before each upgrade. On paper it works, but I'm afraid it may cause intermittent issues because there will be a window of time in which the service will not be enabled in /etc/nsswitch.conf. In case of a failed upgrade that window may be arbitrarily long and if that service is something needed to log in, the admin may end up locked out of their accounts. Another option, more in line with what sssd and autofs need at the moment, would be to state something along the lines of ".nss files can only be added to or removed from a package; changing the content of .nss files between package versions is not allowed without additional ad-hoc code in maintscripts". Both options are unsatisfactory. Option 2 is perhaps the best to unblock the current sssd situation. I'll do some other testing and play with these two options during the weekend, then release a version that will at least unblock sssd. Ideas and comments are welcome!
Hi Gioele, Thanks for the info update and for providing a fix to unblock sssd. Mike
Hi Mike, On Fri, 02 Oct 2026 15:58:00 +0000 Mike Gabriel <sunweaver@debian.org> wrote: matches the reality, can you please confirm my reading of the solution you agreed upon in the other bugs? From <https://bugs.debian.org/1147179#30>: ## sudo sudoers database-add sudoers first files ## libsss-sudo Pre-Depends: sudo (>= $some-version) sudoers database-require sudoers after=files sss Regards,
Hi Gioele, Confirming! That's the proposed solution, indeed. Mike
Hi, I have uploaded dh-nss v1.8~exp2 to experimental. The new code should fix the issue that affect sssd and sudo (although many other problems are still lurking.) Please test. I'll wait for your feedback before uploading v1.8 to unstable. Regards,
Do you need that change in an experimental sudo upload? Greetings Marc
Hi Marc, For my testing, this is not needed. I am currently down with a cold, so not sure when I will get to testing this. (Not longer than beginning of next week, I hope). Mike
Hi Gioele, hi Marc,
I think we are good to go with dh-nss v1.8.
I ran various installation and upgrade tests now and v1.8 seems stable
enough to cover all upgrade/installation pathways I have tested:
* [x] neither sudo, nor libsss-sudo installed; install my sudo,
nsswitch.conf: sudoers: files
* [x] neither sudo, nor libsss-sudo installed; install both of my
package versions, nsswitch.conf: sudoers: files sss
* [x] sudo installed, upgrade to new sudo version with sudo.nss
included, nsswitch.conf: sudoers: files
* [x] sudo installed, manual change of nsswitch.conf: sudoers:
ldap, install new sudo version, nsswitch.conf: sudoers: files ldap
* [x] sudo installed, manual change of nsswitch.conf: sudoers:
ldap, install new sudo and new libsss-sudo version, nsswitch.conf:
sudoers: files ldap sss
(note, that I'll probably go with "sudoers last sss" in
libsss-sudo.nss)
* [x] sudo installed, libsss-sudo installed, upgrade to my local
pkg versions, nsswitch.conf: sudoers: files sss
* etc. (I guess I tested some more, but did not write them all down)
The .debdiffs I used:
sudo:
```
locadm@libsss-sudo-1129522:~$ debdiff sudo_1.9.17p2-9.dsc
sudo_1.9.17p2-9.1.dsc
diff -Nru sudo-1.9.17p2/debian/changelog sudo-1.9.17p2/debian/changelog
--- sudo-1.9.17p2/debian/changelog 2026-09-28 12:40:42.000000000 +0000
+++ sudo-1.9.17p2/debian/changelog 2026-10-09 05:39:58.000000000 +0000
@@ -1,3 +1,10 @@
+sudo (1.9.17p2-9.1) UNRELEASED; urgency=medium
+
+ * debian/sudo.nss:
+ + Authoritatively manage sudoers: entry in nsswitch.conf.
+
+ -- <sunweaver@debian.org> Fri, 09 Oct 2026 05:39:58 +0000
+
sudo (1.9.17p2-9) unstable; urgency=medium
* Apply upstream patches to address CVE-2026-96512.
diff -Nru sudo-1.9.17p2/debian/control sudo-1.9.17p2/debian/control
--- sudo-1.9.17p2/debian/control 2026-09-28 12:40:42.000000000 +0000
+++ sudo-1.9.17p2/debian/control 2026-10-09 05:39:58.000000000 +0000
@@ -10,6 +10,7 @@
Build-Depends:
debhelper-compat (= 13),
dh-sequence-installnss,
+ dh-nss (>= 1.8~),
Build-Depends-Arch:
autoconf,
bison,
diff -Nru sudo-1.9.17p2/debian/sudo.nss sudo-1.9.17p2/debian/sudo.nss
--- sudo-1.9.17p2/debian/sudo.nss 1970-01-01 00:00:00.000000000 +0000
+++ sudo-1.9.17p2/debian/sudo.nss 2026-09-09 20:34:35.000000000 +0000
@@ -0,0 +1,3 @@
+sudoers database-add
+
+sudoers first files
```
sssd:
```
locadm@libsss-sudo-1129522:~$ debdiff sssd_2.13.1-3.dsc sssd_2.13.1-3.1.dsc
diff -Nru sssd-2.13.1/debian/changelog sssd-2.13.1/debian/changelog
--- sssd-2.13.1/debian/changelog 2026-09-08 11:05:35.000000000 +0000
+++ sssd-2.13.1/debian/changelog 2026-10-09 04:20:16.000000000 +0000
@@ -1,3 +1,15 @@
+sssd (2.13.1-3.1) UNRELEASED; urgency=medium
+
+ * Rebuild against dh-nss 1.8~.
+ * debian/libsss-sudo:
+ + Adjust rules, expect sudo bin:pkg to own the sudoers: entry in
+ nsswitch.conf.
+ * debian/patches:
+ + Add gdm-51-pam-extension-macros-compat.patch. Fix building against
+ libgdm-dev (>= 51).
+
+ -- <sunweaver@debian.org> Fri, 09 Oct 2026 04:20:16 +0000
+
sssd (2.13.1-3) unstable; urgency=medium
* debian/tests/control: Explicitly have tests requiring
openssh-client depend
diff -Nru sssd-2.13.1/debian/control sssd-2.13.1/debian/control
--- sssd-2.13.1/debian/control 2026-09-08 11:05:33.000000000 +0000
+++ sssd-2.13.1/debian/control 2026-10-09 04:20:16.000000000 +0000
@@ -12,6 +12,7 @@
dh-apparmor,
dh-python,
dh-sequence-installnss,
+ dh-nss (>= 1.8~),
bind9-dnsutils,
docbook-xml,
docbook-xsl,
@@ -372,6 +373,7 @@
Package: libsss-sudo
Section: libs
Architecture: any
+Pre-Depends: ${misc:Pre-Depends}, sudo (>= 1.9.17p2-9.1~)
Depends: ${misc:Depends}, ${shlibs:Depends}
Description: Communicator library for sudo
Utility library to allow communication between sudo and SSSD for caching
diff -Nru sssd-2.13.1/debian/libsss-sudo.nss
sssd-2.13.1/debian/libsss-sudo.nss
--- sssd-2.13.1/debian/libsss-sudo.nss 2026-09-08 11:05:33.000000000 +0000
+++ sssd-2.13.1/debian/libsss-sudo.nss 2026-10-09 04:20:16.000000000 +0000
@@ -1,3 +1,3 @@
-sudoers database-add
+sudoers database-require
sudoers last sss
diff -Nru
sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch
sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch
---
sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch 1970-01-01
00:00:00.000000000 +0000
+++
sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch 2026-10-09
04:20:16.000000000 +0000
@@ -0,0 +1,54 @@
+Description: Fix FTBFS with GDM 51 PAM extension headers
+ GDM 51 rewrote its gdm-pam-extensions headers, replacing the uppercase
+ function-like macros with static inline functions.
+Author: Renan Rodrigo <rr@ubuntu.com>
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/2163336
+Forwarded: https://github.com/SSSD/sssd/pull/9076
+Last-Update: 2026-08-12
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+Index: sssd-2.13.1/src/sss_client/pam_sss.c
+===================================================================
+--- sssd-2.13.1.orig/src/sss_client/pam_sss.c
++++ sssd-2.13.1/src/sss_client/pam_sss.c
+@@ -67,6 +67,40 @@
+ #endif
+ #endif /* HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION */
+
++/* GDM 51 replaced the uppercase function-like macros of its PAM extension
++ * headers with lowercase static inline functions. Provide the old macro
++ * names as aliases so the code below keeps compiling with both old and new
++ * gdm-pam-extensions. */
++#ifdef HAVE_GDM_PAM_EXTENSIONS
++#ifndef GDM_PAM_EXTENSION_SUPPORTED
++#define GDM_PAM_EXTENSION_SUPPORTED(name) \
++ gdm_pam_extension_supported(name)
++#endif
++#ifndef GDM_PAM_EXTENSION_MESSAGE_TO_BINARY_PROMPT_MESSAGE
++#define
GDM_PAM_EXTENSION_MESSAGE_TO_BINARY_PROMPT_MESSAGE(extended_message,
binary_message) \
++
gdm_pam_extension_message_to_binary_prompt_message((GdmPamExtensionMessage
*)(extended_message), binary_message)
++#endif
++#ifndef GDM_PAM_EXTENSION_CHOICE_LIST_REQUEST_INIT
++#define GDM_PAM_EXTENSION_CHOICE_LIST_REQUEST_INIT(request, title,
num_items) \
++ gdm_pam_extension_choice_list_request_init(request, title, num_items)
++#endif
++#ifndef GDM_PAM_EXTENSION_REPLY_TO_CHOICE_LIST_RESPONSE
++#define GDM_PAM_EXTENSION_REPLY_TO_CHOICE_LIST_RESPONSE(reply) \
++ gdm_pam_extension_reply_to_choice_list_response(reply)
++#endif
++#endif /* HAVE_GDM_PAM_EXTENSIONS */
++
++#ifdef HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION
++#ifndef GDM_PAM_EXTENSION_CUSTOM_JSON_REQUEST_INIT
++#define GDM_PAM_EXTENSION_CUSTOM_JSON_REQUEST_INIT(request,
proto_name, proto_version, json_str) \
++ gdm_pam_extension_custom_json_request_init(request, proto_name,
proto_version, json_str)
++#endif
++#ifndef GDM_PAM_EXTENSION_REPLY_TO_CUSTOM_JSON_RESPONSE
++#define GDM_PAM_EXTENSION_REPLY_TO_CUSTOM_JSON_RESPONSE(reply) \
++ gdm_pam_extension_reply_to_custom_json_response(reply)
++#endif
++#endif /* HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION */
++
+ #include "sss_pam_compat.h"
+ #include "sss_pam_macros.h"
+
diff -Nru sssd-2.13.1/debian/patches/series sssd-2.13.1/debian/patches/series
--- sssd-2.13.1/debian/patches/series 2026-09-08 11:05:33.000000000 +0000
+++ sssd-2.13.1/debian/patches/series 2026-10-09 04:20:16.000000000 +0000
@@ -9,3 +9,4 @@
CVE-2026-68742.diff
CVE-2026-68743.diff
CVE-2026-68744.diff
+gdm-51-pam-extension-macros-compat.patch
```
Greets,
Mike
Hi Mike, On Fri, 09 Oct 2026 06:21:06 +0000 Mike Gabriel <sunweaver@debian.org> wrote: Thanks Mike, also for the initial bug report and patch. I have released v1.8 with the fix. Regards,
Hi Gioele, hi Marc, thanks for the upload, Gioele. @Marc: Your turn regarding sudo... Mike
Will do, hopefully later this week. I apologize for being unresponsive. Greetings Marc
What exactly am I supposed to do? Which files does sudo have to put where? I am sorry for having lost context. Greetings Marc