From c4dd605e4e41d8a848c4aae0786f71800e8bb9d2 Mon Sep 17 00:00:00 2001 From: Nitin Krishna Mucheli Date: Tue, 22 Sep 2026 17:18:50 +0530 Subject: [PATCH] images/ubuntu: Unbreak sudo(8) for Ubuntu 25.10 and 26.04 Ubuntu 25.10 switched [1] from the sudo.ws [2] implementation of sudo(8) to sudo-rs [3]. A bug in the new implementation's use of the Pluggable Authentication Modules for Linux (or PAM) prevents it from working when invoked by a password-less user [4]. Work around this by adding a NOPASSWD tag to users in the 'sudo' group through a /etc/sudoers.d configuration snippet. The sudo.ws implementation in version 1.8.5 relaxed the requirement that /etc/sudoers and the snippets included from it must have 0440 as file permission [5], and the sudo-rs implementation behaves the same. Even then, the /etc/sudoers.d configuration snippet was set to 0440 for better hygiene. [1] https://trifectatech.org/blog/memory-safe-sudo-to-become-the-default-in-ubuntu/ https://discourse.ubuntu.com/t/adopting-sudo-rs-by-default-in-ubuntu-25-10 https://discourse.ubuntu.com/t/sudo-rs-is-now-default-for-questing-quokka [2] https://www.sudo.ws/ https://github.com/sudo-project/sudo [3] https://github.com/trifectatechfoundation/sudo-rs [4] sudo-rs commit 5debfcf1aa775201 https://github.com/trifectatechfoundation/sudo-rs/commit/5debfcf1aa775201 https://github.com/trifectatechfoundation/sudo-rs/pull/1657 https://github.com/trifectatechfoundation/sudo-rs/issues/1656 [5] sudo-ws commit 415454ff59c1dab3 https://github.com/sudo-project/sudo/commit/415454ff59c1dab3 https://github.com/sudo-project/sudo/blob/main/NEWS https://github.com/containers/toolbox/issues/1807 --- images/ubuntu/25.10/Containerfile | 7 +++++++ images/ubuntu/26.04/Containerfile | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/images/ubuntu/25.10/Containerfile b/images/ubuntu/25.10/Containerfile index 069409c75..a4e89b5a0 100644 --- a/images/ubuntu/25.10/Containerfile +++ b/images/ubuntu/25.10/Containerfile @@ -27,6 +27,13 @@ RUN apt-get update && \ rm -rd /var/lib/apt/lists/* RUN rm /extra-packages +# Work around https://github.com/trifectatechfoundation/sudo-rs/issues/1656 +# Fixed in sudo-rs 0.2.15: +# https://github.com/trifectatechfoundation/sudo-rs/pull/1657 +# https://github.com/trifectatechfoundation/sudo-rs/commit/5debfcf1aa775201 +RUN echo "%sudo ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/90-toolbx-nopasswd && \ + chmod 0440 /etc/sudoers.d/90-toolbx-nopasswd + # Enable the use of p11-kit-client.so to access CA certificates from the host RUN mkdir --parents /etc/pkcs11/modules diff --git a/images/ubuntu/26.04/Containerfile b/images/ubuntu/26.04/Containerfile index f5854da08..961c28e86 100644 --- a/images/ubuntu/26.04/Containerfile +++ b/images/ubuntu/26.04/Containerfile @@ -27,6 +27,13 @@ RUN apt-get update && \ rm -rd /var/lib/apt/lists/* RUN rm /extra-packages +# Work around https://github.com/trifectatechfoundation/sudo-rs/issues/1656 +# Fixed in sudo-rs 0.2.15: +# https://github.com/trifectatechfoundation/sudo-rs/pull/1657 +# https://github.com/trifectatechfoundation/sudo-rs/commit/5debfcf1aa775201 +RUN echo "%sudo ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/90-toolbx-nopasswd && \ + chmod 0440 /etc/sudoers.d/90-toolbx-nopasswd + # Enable the use of p11-kit-client.so to access CA certificates from the host RUN mkdir --parents /etc/pkcs11/modules