Bug 151938

Summary: sudo moronic
Product: [openSUSE] SUSE Linux 10.1 Reporter: Andreas Gruenbacher <agruen>
Component: BasesystemAssignee: Marian Jancar <mjancar>
Status: RESOLVED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Normal    
Priority: P5 - None CC: security-team, suse-beta
Version: Beta 4   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: Other Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Andreas Gruenbacher 2006-02-17 20:22:51 UTC
Sudo, in its default configuration on Beta4, asks for root's password before executing a command. Then it checks if the user has the appropriate privileges defined in /etc/sudoers. This is stupid: when a user knows the root password, the command should just be executed; the user could edit /etc/sudoers, anyway.
Comment 1 Christian Boltz 2006-02-18 00:01:26 UTC
The reason is "Defaults targetpw" in the configfile.

This was introduced some SUSE releases ago IIRC - but don't ask me for the reason or why it should be useful this way...
Comment 2 Andreas Gruenbacher 2006-02-18 00:09:23 UTC
My point was that after the user has entered the root password, it makes no sense to deny running the command; the command should just be executed. Maybe this can be simply achieved with the right configuration options in /etc/sudoers.
Comment 3 Ludwig Nussel 2006-02-20 10:15:52 UTC
took me a while to understand what your problem is. I suppose you tried to run sudo with your nis user which is not in group 'users'. The sudoers file allows only members of group 'users' to run commands. Since anyone is allowed to use su if he know the password it should be fine to also allow anyone to use sudo.
You need to change '%users' to 'ALL' to achieve that.
Comment 4 Andreas Gruenbacher 2006-02-20 10:58:08 UTC
How much sense does that make as the default configuration? IMO none; it should not matter in which groups users are that know the root password.
Comment 5 Marian Jancar 2006-03-08 14:42:26 UTC
fixed