log_subcmds is breaking shebangs

[yamrzou]

Causing "bad interpreter: No such file or directory"

Steps:

As the root user:

• In visudo add the following lines (taken from here):

Defaults log_format=json
Defaults log_subcmds
Defaults:%wheel runchroot=*
Defaults log_input, log_output
Defaults !log_passwords
Defaults log_servers=0.0.0.0

• create a file debug in root's home, with the following content:

#!/bin/bash
echo hello

• Make executable: chmod +x debug
• Add user bob to sudoers: usermod -aG sudo bob

============================================

Try with log_subcmds enabled:

• login as user bob
• sudo bash
• cd $HOME
• ./debug
  bash: ./debug: /bin/bash: bad interpreter: No such file or directory

Try with log_subcmds disabled (commented):

• login as user bob
• sudo bash
• cd $HOME
• ./debug
  hello

[millert]

What version of sudo are you running and on what OS?

[yamrzou]

OS: Debian GNU/Linux 11 (bullseye)
Sudo version 1.9.12

[millert]

Thanks, I've managed to reproduce it. The key is that the debug script must not be in the same directory that sudo was started from. It looks like there is still an issue with running relative commands from a different cwd.

[yamrzou]

Thank you for looking into it.

I originally stumbled upon this bug when doing apt install ... inside a sudo shell, which returned the following error:

/bin/sh: 1: /usr/bin/apt-listchanges: not found
E: Sub-process /usr/bin/apt-listchanges --apt || test $? -lt 10 returned an error code (1)
E: Failure running script /usr/bin/apt-listchanges --apt || test $? -lt 10

Which happened because /usr/bin/apt-listchanges contains a shebang #!/usr/bin/python3.

[millert]

Closing this as fixed by 8db1eb0

[yamrzou]

I think there is still an issue with log_subcmds:

I'm following the following tutorial: https://soapbox.pub/install/.

When trying to install Erlang by executing the following inside the sudo session (sudo -Hu pleroma bash):

git clone https://github.com/asdf-vm/asdf.git ~/.asdf --branch v0.10.0
echo ". $HOME/.asdf/asdf.sh" >> ~/.bashrc
echo ". $HOME/.asdf/completions/asdf.bash" >> ~/.bashrc
exec bash
asdf plugin-add erlang
asdf plugin-add elixir
asdf install

When log_subcmds is enabled, the last step fails with:

Configure failed.
/var/lib/pleroma/.asdf/plugins/erlang/kerl: 926: ./otp_build: not found

When I comment it out, the installation succeeds:

Erlang/OTP 24.3.4.2 (asdf_24.3.4.2) has been successfully built

I couldn't work out a smaller example, but the only changing factor here is whether log_subcmds is enabled.
Sudo version: 1.9.12p2

[millert]

Thanks for reporting this, I was able to reproduce it with the information you provided. This is a different issue that only shows up when running a command with a very large argument vector. It is fixed by fe001b6 which will be in the next sudo 1.9.13 beta.

[yamrzou]

Thank you for the quick fix!