sudo-rs
sudo-rs copied to clipboard
Handle missing `/etc/sudoers` with grace
Describe the feature you'd like see implemented in sudo-rs
If /etc/sudoers is missing, give a better error message than "file not found".
or
do something else that can be appropriate: interpret a missing sudoers file as:
- All settings have their default value (like an empty sudoers file)
- There is the implicit rule, which does what people naively expect sudo to do: grant escalationg privileges to people in the
sudoersgroup.
What problem can be solved with this feature? Users can end up in this situation by the present state of some packaging, or if they install our tarballs on a clean sudo-less system without creating a /etc/sudoers.
Additional context
I don't think the situation where a missing /etc/sudoers is interpreted as %sudoers ALL=ALL diminishes security: the /etc/sudoers file is considered part of the trusted config...
CC #1301
Team discussion: supplying a sane default would be useful, but not every system has the same "sudoers group". Other alternatives (e.g. asking for a root password and bootstrap sudo by launching visudo) also run into difficulties.
So most likely we will have to stick with improving the error message.