search

trifectatechfoundation / sudo-rs

A memory safe implementation of sudo and su.
Other
2.92k stars 79 forks source link

Add feature to enable/disable usage of the sudo-i pam service name #903

Open bjorn3 opened 2 weeks ago

bjorn3 commented 2 weeks ago

Describe the feature you'd like see implemented in sudo-rs See title

What problem can be solved with this feature? It varies a lot between systems whether or not /etc/pam.d/sudo-i is used or not. This is not directly correlated with the target os, so using #[cfg] is not possible. For example upstream sudo only enables --with-pam-login to use /etc/pam.d/sudo-i on the RedHat family of distros, but Debian also manually enables it for their distro packages: https://salsa.debian.org/sudo-team/sudo/-/blob/master/debian/rules?ref_type=heads#L18

Describe alternatives you've considered Using #[cfg(target_os = "linux")] to enable it, but this wouldn't work on distros like Alpine that don't use --with-pam-login.

squell commented 2 weeks ago

I concur; we've had this issue with Arch Linux before (see issue #832). I think the feature flag mechanism is the correct way to handle this.