Documentation for the `sudoers` tag specification is oblivious to whitespace

[0x2b3bfa0]

%admin ALL=(ALL) NOPASSWD: ALL  # documented syntax
%admin ALL=(ALL) NOPASSWD : ALL  # unexpected alternative

The following paragraph might imply, but doesn't explicitly specify, that tags can “optionally” contain whitespace between the identifier and the final colon.

White space between elements in a list as well as special syntactic characters in a User Specification (=, :, (, )) is optional.

Excerpts

Documentation

Other special characters and reserved words

sudo/docs/sudoers.mdoc.in

Lines 2393 to 2403 in e4ea5ad

	.Pp
	White space between elements in a list as well as special syntactic
	characters in a
	.Em User Specification
	.Po
	.Ql =\& ,
	.Ql :\& ,
	.Ql (\& ,
	.Ql )\&
	.Pc
	is optional.

User specification

sudo/docs/sudoers.mdoc.in

Lines 1265 to 1269 in e4ea5ad

	Tag_Spec ::= ('EXEC:' | 'NOEXEC:' | 'FOLLOW:' | 'NOFOLLOW' |
	'LOG_INPUT:' | 'NOLOG_INPUT:' | 'LOG_OUTPUT:' |
	'NOLOG_OUTPUT:' | 'MAIL:' | 'NOMAIL:' | 'INTERCEPT:' |
	'NOINTERCEPT:' | 'PASSWD:' | 'NOPASSWD:' | 'SETENV:' |
	'NOSETENV:')

Lexer

sudo/plugins/sudoers/toke.l

Lines 485 to 565 in 2d6b9d2

	NOPASSWD[[:blank:]]*: {
	/* cmnd does not require passwd for this user */
	LEXTRACE("NOPASSWD ");
	return NOPASSWD;
	}
	PASSWD[[:blank:]]*: {
	/* cmnd requires passwd for this user */
	LEXTRACE("PASSWD ");
	return PASSWD;
	}
	NOEXEC[[:blank:]]*: {
	LEXTRACE("NOEXEC ");
	return NOEXEC;
	}
	EXEC[[:blank:]]*: {
	LEXTRACE("EXEC ");
	return EXEC;
	}
	INTERCEPT[[:blank:]]*: {
	LEXTRACE("INTERCEPT ");
	return INTERCEPT;
	}
	NOINTERCEPT[[:blank:]]*: {
	LEXTRACE("NOINTERCEPT ");
	return NOINTERCEPT;
	}
	SETENV[[:blank:]]*: {
	LEXTRACE("SETENV ");
	return SETENV;
	}
	NOSETENV[[:blank:]]*: {
	LEXTRACE("NOSETENV ");
	return NOSETENV;
	}
	LOG_OUTPUT[[:blank:]]*: {
	LEXTRACE("LOG_OUTPUT ");
	return LOG_OUTPUT;
	}
	NOLOG_OUTPUT[[:blank:]]*: {
	LEXTRACE("NOLOG_OUTPUT ");
	return NOLOG_OUTPUT;
	}
	LOG_INPUT[[:blank:]]*: {
	LEXTRACE("LOG_INPUT ");
	return LOG_INPUT;
	}
	NOLOG_INPUT[[:blank:]]*: {
	LEXTRACE("NOLOG_INPUT ");
	return NOLOG_INPUT;
	}
	MAIL[[:blank:]]*: {
	LEXTRACE("MAIL ");
	return MAIL;
	}
	NOMAIL[[:blank:]]*: {
	LEXTRACE("NOMAIL ");
	return NOMAIL;
	}
	FOLLOW[[:blank:]]*: {
	LEXTRACE("FOLLOW ");
	return FOLLOWLNK;
	}
	NOFOLLOW[[:blank:]]*: {
	LEXTRACE("NOFOLLOW ");
	return NOFOLLOWLNK;
	}

Note that it uses the blank character class, so <tab> would produce the same effect.