sudoers.d file, /etc/sudoers.d/99-snapd.conf included with snapd is improperly named and limits PATH under sudo (for most users) to /snap/bin
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
snapd |
Triaged
|
Low
|
Unassigned |
Bug Description
sudo won't process any names with a ~ or a '.' in them*, so the desired outcome, adding /snap/bin to a sudo user's PATH is not happening due to this file.
$ sudo ls -l /etc/sudoers.d/
total 16
-r--r----- 1 root root 2614 Oct 9 06:19 99-default-user
-r--r----- 1 root root 91 Jul 10 06:59 99-snapd.conf
-r--r----- 1 root root 958 Feb 3 2020 README
-r--r----- 1 root root 666 Sep 26 2019 zfs
You can see that it does not get processed by running `sudo visudo -c`
$ sudo visudo -c
/etc/sudoers: parsed OK
/etc/sudoers.
/etc/sudoers.
/etc/sudoers.d/zfs: parsed OK
Second issue is that since there's no default "env_keep" configured with sudo, the sudo users path is limited to "/snap/bin" since 99-snapd.conf is one of the last files executed.
$ sudo mv /etc/sudoers.
snap-test@
/usr/local/
$ sudo -i bash -c 'set|grep "^SUDO|^PATH"'
-bash: bash: command not found
$ sudo su -
sudo: su: command not found
$ sudo -i /usr/bin/bash
bash: groups: command not found
Command 'lesspipe' is available in the following places
* /bin/lesspipe
* /usr/bin/lesspipe
The command could not be located because '/bin:/usr/bin' is not included in the PATH environment variable.
lesspipe: command not found
Command 'dircolors' is available in the following places
* /bin/dircolors
* /usr/bin/dircolors
The command could not be located because '/bin:/usr/bin' is not included in the PATH environment variable.
dircolors: command not found
* /etc/sudoers.
$ sudo cat /etc/sudoers.
#
# As of Debian version 1.7.2p1-1, the default /etc/sudoers file created on
# installation of the package now includes the directive:
#
# #includedir /etc/sudoers.d
#
# This will cause sudo to read and parse any files in the /etc/sudoers.d
# directory that do not end in '~' or contain a '.' character.
#
The incorrect suodoes configuration file was removed in https:/ /github. com/snapcore/ snapd/pull/ 8885 - referencing https:/ /bugs.launchpad .net/snapd/ +bug/1882215
It is possible that the file remained across updates as it was likely marked as a conffile. Looking at the snapd.postinst script I do not see any logic removing it.