#1152951 sudo: prevent duplicate Bison invocations during parallel sudoers builds

Package:
sudo
Source:
sudo
Description:
Provide limited super user privileges to specific users
Submitter:
Marcel Jueling
Date:
2026-11-03 17:53:02 UTC
Severity:
normal
Tags:
#1152951#5
Date:
2026-11-03 17:25:59 UTC
From:
To:
Dear Debian Sudo Maintainers,

The sudoers parser generation rule in plugins/sudoers/Makefile.in uses
an ordinary multi-target rule:

|$(devdir)/gram.c $(devdir)/gram.h: $(srcdir)/gram.y prologue|

The recipe invokes Bison to generate both parser files. Under parallel
builds, the ordinary multi-target rule may cause the recipe to be
invoked more than once. Duplicate Bison invocations were observed in
build logs. The logs do not establish whether the invocations actually
overlapped, but the shared temporary output files make this a potential
race.

The attached patch changes the rule to a GNU make grouped target:

|$(devdir)/gram.c $(devdir)/gram.h &: $(srcdir)/gram.y prologue|

This ensures that the recipe is run once for the grouped targets.

Grouped explicit targets require GNU make 4.3 or newer.

Testing was performed on Debian 13 (Trixie) with GNU make 4.4.1 and
Bison 3.8.2:

  *

    Parallel builds with |make -j4|succeeded.

  *

    Separate test build directories each invoked Bison exactly once.

  *

    Both generated parser files were present and byte-identical to the
    previous generated files.

  *

    The patch was integrated into the Debian quilt patch series.

  *

    A complete Debian package build succeeded on a second Debian 13
    host, producing version 1.9.16p2-3+deb13u3.

The proposed fix is attached.

Best regards

Marcel Jueling

#1152951#10
Date:
2026-11-03 17:50:08 UTC
From:
To:
Hi Marcel,

Can you reproduce this on Debian unstable? We are not going to issue a
stable update to fix this.

If this is still present in unstable, I'd encourage you to file an
upstream bug about this, as this fix is probably interesting for all
distibutions shipping sudo.

Greetings
Marc