sudo-rs tracking issue

[mkg20001]

sudo-rs is coming to nixos

The roadmap

• sudo-rs packaged (sudo-rs: package and use as replacement for 'sudo' #252193)
• sudo module adjusted to work with current sudo-rs (nixos/sudo: Add support for sudo-rs #253876)
• all patches upstreamed
  • skip self check when run as root (update self_check function to work with sudo invoked through setuid wrapper trifectatechfoundation/sudo-rs#772)
• sudo-rs implements all features needed for basic nixos sudo config
  • $feature ($sudo-rs issue)
  • SETENV/NOSETENV (SETENV/NOSETENV option trifectatechfoundation/sudo-rs#760)
  • Specific Defaults parser+checking trifectatechfoundation/sudo-rs#61
  • --prompt/-p is used by several tools, inculding nixos-rebuild-ng (SUDO_PROMPT implementation request trifectatechfoundation/sudo-rs#842)
• sudo-rs and sudo have feature parity as far as nixpkgs is concerned

[nyabinary]

What patches need to be upstreamed?

[mkg20001]

@nyabinary added

[nbraud]

@mkg20001 Here's another upstream issue we need for full parity between sudo and sudo-rs, as far as extent NixOS modules are concerned.

[yorickvP]

Another minor difference: It looks like sudo-rs does not support wildcards in arguments, opting to interpret them as literal wildcards instead

[squell]

The skip self check when run as root has been adopted by the sudo-rs team: trifectatechfoundation/sudo-rs#772.

[squell]

Another minor difference: It looks like sudo-rs does not support wildcards in arguments, opting to interpret them as literal wildcards instead

@yorickvP is correct, we actually actively removed that functionality here: trifectatechfoundation/sudo-rs#334 (in technical terms, changing the matcher for arguments from a glob::Pattern into a Option<Box<[String]>>).

[mkg20001]

Another minor difference: It looks like sudo-rs does not support wildcards in arguments, opting to interpret them as literal wildcards instead

According to trifectatechfoundation/sudo-rs#333 it still works in the config, where it's necesarry.

In the shell, resolving wildcards should be the shell's responsibility. Bash will likely already do it for you if you un-quote the argument.

[r-vdp]

Added trifectatechfoundation/sudo-rs#842 to the list.