Clarification in man page around command comma-list parsing

[aayla-secura]

The man page says:

Once a tag is set on a Cmnd, subsequent Cmnds in the
Cmnd_Spec_List, inherit the tag unless it is overridden by the opposite tag (in other words, PASSWD overrides
NOPASSWD and NOEXEC overrides EXEC).

And defines a Cmnd_Spec_List as a comma-separated list of Cmnd_Spec, and Cmnd_Spec including an optional Runas_Spec. It sounds like in the following entry:

test ALL = (root) NOPASSWD: /bin/ls, (nobody) /usr/bin/id

the id Cmnd_Spec should inherit the NOPASSWD tag, but in fact it doesn't. The tag is inherited only if subsequent Cmnds in the list don't include a Runas_Spec, e.g. the following cases:

test ALL = (root) NOPASSWD: /bin/ls, ROLE=selinux /usr/bin/id
test ALL = (root) NOPASSWD: /bin/ls, MAIL: /usr/bin/id
test ALL = (root) NOPASSWD: /bin/ls, /usr/bin/id

Is this intended or a bug? If intended, the man page should state it.

The same applies to the propagation/inheritance of Selinux specifications.

[millert]

I can't reproduce this, the NOPASSWD tags gets inherited with your first example. There does appear to be a bug in the sudo -l output but sudo -ll shows the correct information and sudo does not require a password for sudo -u nobody /usr/bin/id

[aayla-secura]

Interesting. v1.9.9 definitely requires a password for id:

$ sudo -ll
Matching Defaults entries for test on ip-172-31-44-38:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User test may run the following commands on ip-172-31-44-38:

Sudoers entry:
    RunAsUsers: root
    Options: !authenticate
    Commands:
        /bin/ls

Sudoers entry:
    RunAsUsers: nobody
    Options: !authenticate
    Commands:
        /usr/bin/id

ls requires no password:

$ sudo ls

id does:

$ which id
/usr/bin/id
$ sudo id
[sudo] password for test:
sudo: a password is required
$ ^C

$ sudo --version
Sudo version 1.9.9
Sudoers policy plugin version 1.9.9
Sudoers file grammar version 48
Sudoers I/O plugin version 1.9.9
Sudoers audit plugin version 1.9.9

[millert]

That is because you are trying to run id as root, not nobody. If you run sudo -u nobody id it will not prompt for a password.

[aayla-secura]

That is because you are trying to run id as root, not nobody. If you run sudo -u nobody id it will not prompt for a password.

Oh boy, you're right, my bad :)