Package: sudo Version: 1.9.17p2-7 Severity: wishlist Hi Marc, in the course of getting sssd back into Debian testing, I came across this last RC bug to fix: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129522 The bug report is valid and reproducible in a test setup. In a previous bug fix, it was decided that libsss-sudo owns the sudoers: entry in nsswitch.conf. When we install the package, it adds sudoers: sss and sudo immediately stops seeing /etc/sudoers. There are two meaningful approaches how to address this: add the sudoers: entry to base-files (and make it an official field in nsswitch.conf) or (and I think this hadn't come up, so far) sudo itself owns that nsswitch.conf key/entry. In fact, sudo works well with /etc/sudoers without an entry in nsswitch.conf. However, it does not hurt if `sudoers: files` exists in nsswitch.conf, either. And what package could better own this entry in nsswitch.conf than sudo itself??? So here is my idea: * you add a debian/sudo.nss file into the sudo src:pkg with the following content: ``` sudoers database-add sudoers first files ``` * And for all other consumers, such as sssd, we add: debian/control: Pre-Depends: sudo (>= <version-that-adds-the-above-file>) debian/lib<foo>-sudo.nss ``` sudoers database-require sudoers after=files <foo> ``` What do you think? If I have to fix #1129522 only from within libsss-sudo, it gets really hacky and I'd like to avoid that. Thanks! Mike
Hi Mike, Shouldn't src:sudo's libsss-sudo.deb deliver that file, and to where? I am planning to do an experimental upload of sudo soonish, so we can actually try that. I'd like to hear the oder sudo team members' opinion first, though. In the long run, Debian should have a package like nss-helper that can own the nss files and provide programmatic interfaces to them. This should be discussed on debian-devel. But of course we need a quickfix for this because of sssd. Greetings Marc
Hi Marc,
```
sudoers database-add
sudoers first files
sudoers last sss
```
And it nearly worked:
CASE-1: OK
* no sudoers: key in nsswitch.conf
-> result (on install): sudoers: files sss (correct)
-> result (after removal): no sudoers: key anymore (correct)
CASE-2: FLAWED
* `sudoers: files` in nsswitch.conf
-> result (on install): `sudoers: files` (so unchanged, wrong!)
-> result (on removal): no sudoers: key anymore (also wrong)
CASE-3: FLAWED
* `sudoers: files ldap` in nsswitch.conf
-> result (on install): `sudoers: files ldap` (wrong, should be:
files ldap sss)
-> result (on removal): `sudoers: ldap` (also wrong, should be:
files ldap)
* etc.
Great!!!
Indeed. Though, not as high a prio for me as the solving the current
situation.
That'd be great. Thanks!
Mike
Hi Mike, I wasn't aware of dh_installnss. Ignore the questions in my previous mails that could be answered by man dh_installnss. Why is that wrong? Why is that wrong? I understand why that is flawed. And putting that in sudo.nss package does it right? I just mailed a proposed specification. Greetings Marc
Hi Marc, sss`, not `sudoers: files`. The point is, that dh_installnss cannot handle adding two nss providers in one .nss file gracefully. back to that. But it removes the complete sudoers: key (note, again with the above .nss config for libsss-sudo). Yes, I assume it will. (I must admit, it is a theory, but I can test that). Ack. Mike
YEZZZ, it does!
What I tested:
* build sudo from unstable with this patch:
```
diff -Nru sudo-1.9.17p2/debian/changelog sudo-1.9.17p2/debian/changelog
--- sudo-1.9.17p2/debian/changelog 2026-09-08 14:22:41.000000000 +0000
+++ sudo-1.9.17p2/debian/changelog 2026-09-09 20:32:38.000000000 +0000
@@ -1,3 +1,10 @@
+sudo (1.9.17p2-9~sunweaver1) UNRELEASED; urgency=medium
+
+ * debian/sudo.nss:
+ + Authoritatively manage sudoers: entry in nsswitch.conf.
+
+ -- <locadm@libsss-sudo-1129522> Wed, 09 Sep 2026 20:32:38 +0000
+
sudo (1.9.17p2-8) unstable; urgency=medium
* Mention in NEWS that secure_path was shortened (Closes: #1141402)
diff -Nru sudo-1.9.17p2/debian/sudo.nss sudo-1.9.17p2/debian/sudo.nss
--- sudo-1.9.17p2/debian/sudo.nss 1970-01-01 00:00:00.000000000 +0000
+++ sudo-1.9.17p2/debian/sudo.nss 2026-09-09 20:32:38.000000000 +0000
@@ -0,0 +1,3 @@
+sudoers database-add
+
+sudoers first files
```
* build sssd with this patch:
```
diff -Nru sssd-2.13.1/debian/changelog sssd-2.13.1/debian/changelog
--- sssd-2.13.1/debian/changelog 2026-09-08 13:05:35.000000000 +0200
+++ sssd-2.13.1/debian/changelog 2026-09-08 22:15:48.000000000 +0200
@@ -1,3 +1,13 @@
+sssd (2.13.1-4~local2) unstable; urgency=medium
+
+ * Team upload.
+
+ * debian/libsss-sudo.nss:
+ + Since 1.9.17p2-9, the sudoers: entry is managed by the sudo package and
+ libsss-sudo can simply piggy-back on that. (Closes: #1129522).
+
+ -- Mike Gabriel <sunweaver@debian.org> Tue, 08 Sep 2026 22:15:48 +0200
+
sssd (2.13.1-3) unstable; urgency=medium
* debian/tests/control: Explicitly have tests requiring
openssh-client depend
diff -Nru sssd-2.13.1/debian/control sssd-2.13.1/debian/control
--- sssd-2.13.1/debian/control 2026-09-08 13:05:33.000000000 +0200
+++ sssd-2.13.1/debian/control 2026-09-08 22:15:48.000000000 +0200
@@ -372,6 +372,7 @@
Package: libsss-sudo
Section: libs
Architecture: any
+Pre-Depends: sudo (>= 1.9.17p2-9~), ${misc:Pre-Depends}
Depends: ${misc:Depends}, ${shlibs:Depends}
Description: Communicator library for sudo
Utility library to allow communication between sudo and SSSD for caching
diff -Nru sssd-2.13.1/debian/libsss-sudo.nss
sssd-2.13.1/debian/libsss-sudo.nss
--- sssd-2.13.1/debian/libsss-sudo.nss 2026-09-08 13:05:33.000000000 +0200
+++ sssd-2.13.1/debian/libsss-sudo.nss 2026-09-08 22:15:48.000000000 +0200
@@ -1,3 +1,3 @@
-sudoers database-add
+sudoers database-require