{"id":7815,"date":"2025-09-15T17:11:44","date_gmt":"2025-09-15T14:11:44","guid":{"rendered":"https:\/\/mummila.net\/kommentit\/?p=7815"},"modified":"2025-09-15T17:11:44","modified_gmt":"2025-09-15T14:11:44","slug":"order-dependency-inconsistency-in-sudoers-parametervalue-parsing-wrt-quotes","status":"publish","type":"post","link":"https:\/\/mummila.net\/kommentit\/2025\/09\/15\/order-dependency-inconsistency-in-sudoers-parametervalue-parsing-wrt-quotes\/","title":{"rendered":"Order-dependency\/inconsistency in sudoers parameter=value parsing wrt. quotes"},"content":{"rendered":"<p><strong>Describe the bug<\/strong><br \/>\nI&#8217;m testing sudo-rs, and came across a bit of weirdness in\u00a0<code>sudoers<\/code>\u00a0parsing, related to quotes and parameter order.<\/p>\n<p><strong>To Reproduce<\/strong><\/p>\n<ol>\n<li><code>$ touch test<\/code><\/li>\n<li>edit\u00a0<code>\/etc\/sudoers.d\/90-ssh-auth-sock<\/code>\u00a0to look like this:<br \/>\n<code>Defaults!\/bin\/chown timestamp_timeout=1,env_keep+=SSH_AUTH_SOCK<\/code><\/li>\n<li><code>$ sudo-rs chown root:root test # this works as expected<\/code><\/li>\n<li>edit\u00a0<code>\/etc\/sudoers.d\/90-ssh-auth-sock<\/code>\u00a0to reorder the parameter=value pairs like this:<br \/>\n<code>Defaults!\/bin\/chown env_keep+=SSH_AUTH_SOCK,timestamp_timeout=1<\/code><\/li>\n<li><code>$ sudo-rs chown jani:jani test # this fails:<\/code><br \/>\n<code>\/etc\/sudoers.d\/90-ssh-auth-sock:1:63: double quotes are required for VAR=value pairs<\/code><br \/>\n<code>Defaults!\/bin\/chown env_keep+=SSH_AUTH_SOCK,timestamp_timeout=1<\/code><br \/>\n<code>                                                              ^<\/code><\/li>\n<\/ol>\n<p><strong>Expected behavior<\/strong><\/p>\n<p>For sudo-rs to perform the command in 5. without error, as it did in point 3.<\/p>\n<p><strong>Environment (please complete the following information):<\/strong><\/p>\n<ul>\n<li>Ubuntu 24.04<\/li>\n<li><code>sudo-rs<\/code>\u00a0commit hash:\u00a0<a href=\"https:\/\/github.com\/trifectatechfoundation\/sudo-rs\/commit\/b434d4d2aec25b7f637e5867687d74316505e7c5\" data-hovercard-type=\"commit\" data-hovercard-url=\"https:\/\/github.com\/trifectatechfoundation\/sudo-rs\/commit\/b434d4d2aec25b7f637e5867687d74316505e7c5\/hovercard\"><tt>b434d4d<\/tt><\/a>\u00a0(precompiled version 0.2.8 binary from the Github release page)<\/li>\n<\/ul>\n<p><strong>Additional context<\/strong><br \/>\nFor background, I&#8217;m using\u00a0<a href=\"https:\/\/linux.die.net\/man\/8\/pam_ssh_agent_auth\">pam_ssh_agent_auth<\/a>\u00a0to authorize my user with SSH keys to run some commands, which requires\u00a0<code>env_keep+=SSH_AUTH_SOCK<\/code>.<\/p>\n<p>I also like have it time out immediately, so I additionally set\u00a0<code>timestamp_timeout=0<\/code>. I initially thought the issue was caused by the zero, but testing with\u00a0<code>timestamp_timeout=1<\/code>\u00a0resulted in the same errors, so that&#8217;s what I&#8217;m using here, for unambiguity.<\/p>\n<p>The caret in the error message points to\u00a0<code>timestamp_timeout<\/code>&#8217;s value, so I&#8217;d assume the logical solution is to quote that value, like this:<\/p>\n<pre><code>Defaults!\/bin\/chown env_keep+=SSH_AUTH_SOCK,timestamp_timeout=\"1\"\r\n<\/code><\/pre>\n<p>But this doesn&#8217;t help:<\/p>\n<pre><code>$ sudo-rs chown jani:jani test\r\n\/etc\/sudoers.d\/90-ssh-auth-sock:1:63: double quotes are required for VAR=value pairs\r\nDefaults!\/bin\/chown env_keep+=SSH_AUTH_SOCK,timestamp_timeout=\"1\"\r\n                                                              ^\r\n<\/code><\/pre>\n<p>So my next thought is to quote both values:<\/p>\n<pre><code>Defaults!\/bin\/chown env_keep+=\"SSH_AUTH_SOCK\",timestamp_timeout=\"1\"\r\n<\/code><\/pre>\n<p>This causes a different error:<\/p>\n<pre><code>$ sudo-rs chown jani:jani test\r\n\/etc\/sudoers.d\/90-ssh-auth-sock:1:65: expected nonnegative number\r\nDefaults!\/bin\/chown env_keep+=\"SSH_AUTH_SOCK\",timestamp_timeout=\"1\"\r\n                                                                ^\r\n<\/code><\/pre>\n<p>The only remaining option is to quote only the first parameter value. Surprisingly, this works:<\/p>\n<pre><code>Defaults!\/bin\/chown env_keep+=\"SSH_AUTH_SOCK\",timestamp_timeout=1\r\n\r\n$ sudo-rs chown jani:jani test\r\n$\r\n<\/code><\/pre>\n<p>With OG sudo, any order or combination of these parameters, quoted or unquoted, works as expected.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I&#8217;m testing sudo-rs, and came across a bit of weirdness in sudoers parsing, related to quotes and parameter order.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8860],"tags":[23025,2679],"class_list":["post-7815","post","type-post","status-publish","format-standard","hentry","category-vianhallintajarjestelmat","tag-sudo","tag-ubuntu","sijainti-github"],"_links":{"self":[{"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/posts\/7815","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/comments?post=7815"}],"version-history":[{"count":1,"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/posts\/7815\/revisions"}],"predecessor-version":[{"id":7816,"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/posts\/7815\/revisions\/7816"}],"wp:attachment":[{"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/media?parent=7815"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/categories?post=7815"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/tags?post=7815"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}