#1151427 sudo: /etc/sudoers.d is 0755 while upstream installs the directory as 0750

Package:
sudo
Source:
sudo
Description:
Provide limited super user privileges to specific users
Submitter:
Laurent Bigonville
Date:
2026-10-21 09:35:02 UTC
Severity:
normal
#1151427#5
Date:
2026-10-20 16:01:34 UTC
From:
To:
Hello,

Upstream installs the /etc/sudoers.d directory with the mode 0750 while
the debian package installs it as 0755.

Shouldn't we follow upstream here?

Kind regards,
Laurent Bigonville
#1151427#10
Date:
2026-10-20 19:40:23 UTC
From:
To:
No, Debian policy trumps upstream here. There is no reason to break sudo¹
in sudo.

Greetings
Marc

¹ having 750 directories breaks tab completion and shell globbing
#1151427#15
Date:
2026-10-20 23:32:55 UTC
From:
To:
Le 20-10-26 à 21:40, Marc Haber a écrit :
But it protects the snippets installed by local administrators that have
potentially wrong permissions, /etc/sudoers is 0440 already.

Are we really putting tab-completion above that? That doesn't sound a
reason from deviating from upstream (and other distributions)

The policy (§10.10) explicitly says "The rules in this section are
guidelines for general use. If necessary you may deviate from the
details below. However, if you do so you must make sure that what is
done is secure and you should try to be as consistent as possible with
the rest of the system." BTW
#1151427#20
Date:
2026-10-21 09:34:25 UTC
From:
To:
Bjørn Mork <bjorn@mork.no> wrote:
Well it prevents an attacker from analyzing the snippets, the exact
reason why /etc/sudoers is 0440.

We could start with the ones that our upstreams think require locked
down permissions, already.

I still find the "it breaks tab-completion" argument weak compared to
adding a layer of security on these snippets